How to make a secured Zigbee network ??

how can i make my system secured ??
I have tried all possible combination in lab.

i have one ZC (xbee coordinator) and three ZED (xbee end devices)

Common setting: ZC/ZED- PAN=123456, ZS=2

case 1)
ZC: EE=1, EO=0/1/2, EK= 0, NK=0

ZED: EE=1, EO=0, EK=0

case 2)
ZC: EE=1, EO=0/1/2, EK= 0, NK=0

ZED: EE=1, EO=1, EK=0

case 3)
ZC: EE=1, EO=0/1/2, EK= 12341234, NK=0

ZED: EE=1, EO=0, EK=0

case 4)
ZC: EE=1, EO=0/1/2, EK= 0, NK=0

ZED: EE=1, EO=0/1, EK=12341234

case 5)
ZC: EE=1, EO=0/1/2, EK= 12341234, NK=0

ZED: EE=1, EO=0/1, EK=432312342

Problems:

  1. In first three case 1 & 2 & 3 are same behave, each power cycle of ZC, it will send EK to ZED.
    Qus. if any unauthorized node(ZED3) comes into network than ZC will send the EK to ZED3 also.

(a) if i set ZC side no. of device = 2 than ZED3 cant join the network. fine
(b) but at the time of ZED is seeping that ZED3 can enter into the network. ???

  1. In case 4 i manually entered some predefined keys. in that situation ZED will not allowed the ZC, because ZC dont have predefined key.
    QUS:(a) how i can overlap the key of ZED or which parameter i have to set by ZC side to control a ZED or update the key. ??

  2. if ZC and ZED both have different keys in this situation
    ZED will not allowed to join any other ZR or ZC, who dont have the same key as ZED.
    Qus(a) how ZC send its own key to ZED and asked to join the network.

  3. my confusion is ZC have EO = 0/1/2/3 & ZED have EO = 0/1
    how and which situation i should use these options. i dint understand the sort description given in user manuals/XCTU. please Explain me the exact meaning of EO option. ??

Thank you in Advanceā€¦

It is really simple. Set a predefined Keys in each of the nodes.
Enable encryption.
Set NJ to 0 on the Coordinator after all of your end device have joined.

yes, i know that, but want to make my end device secure.
tell me meaning of end device side EO parameter, when we should use this parameter and why ??