# ZSM Framework for Autonomous Security Service Level Agreement Life-Cycle Management in B5G Networks
## 1 Introduction  
Fifth generation networks and beyond come with the ability to integrate a very wide range of technologies and devices of all kinds, forming a heterogeneous network whose complexity continues to increase [1]. The variety of requirements brought by these architectures is tightly coupled with complexity and hardware-specific constraints, which make non-automated End-to-End (E2E) service deployment and management an extremely costly activity in terms of time, security, and expenses [2]. In addition, E2E services logically interconnect different functional domains and fall into three categories: Ultra Reliable LowLatency Communications (URLLC), massive Machine Type Communications (mMTC), and enhanced Mobile Broadband (eMMB). Thus, connectivity requirements differ significantly depending on the service type and device capabilities. In this context, ensuring system security and robustness in the presence of network heterogeneity and variability becomes a particularly challenging task [3]. To address this task, research on novel technologies is mainly focused on enabling the softwarization of the network through the virtualization and programmability of its components, as well as its integration with AI and ML engines that learn and manage the system in an optimal way [4]. The envisioned next generation of cellular networks will strongly rely on a multi-stakeholder infrastructure. Seamless resource sharing based on AI automation will enable service interconnection across diverse domains, in the so-called Cloud-in-Continuum. Cooperation between stakeholders strengthens E2E service delivery by addressing competition and trust models in service provisioning. To this aim, B5G establishes well-known technological pillars to fulfill these needs. E2E network slicing, leveraging NFV and SDN paradigms, logically groups and isolates resources and services, while NFV-MANO enables the automation of the NFV life-cycle management. Lastly, DLT-based solutions enhance trustworthiness in information-sharing processes and establish these as three key pillars [5]. However, of the three aforementioned, slicing management through orchestration often relies on human intervention for decision making and responding to context evolution which reduces its effectiveness. To mitigate the limitations of manual interventions, an abstraction layer [6] is proposed as a solution. As a consequence, ETSI defined the Zero-touch network and Service Management (ZSM) standardization working group [7], oriented toward providing autonomous governability of cross-domain service networks, taking humans out of the loop. ZSM is driven by closed loops that coordinate logical steps. The closed loops defined in ZSM enable interaction between system components via intents, aiming to deliver concrete tasks such as slice deployment. ZSM divides the 5G architecture into different Security Management Domains (SMDs), such as RAN, Edge, Transport, Cloud, or Core. Intra-domain management is addressed by the ZSM architecture [8], which defines functional modules that rationally split functionalities (e.g., orchestration, Policy Management, Analytics). These modules and the domain's infrastructure are connected by a closed loop, driven by an intent. Furthermore, ZSM defines an E2E domain that ensures cross-domain integration. A global perspective of the system allows the E2E domain to manage the life-cycle of E2E slices via intents. In this way, ZSM transforms network management into an autonomous, efficient, and agile operation, simplifying cross-domain service composition. This work relies on the theoretical concepts from ETSI's ZSM architecture [8] and E2E Management and Orchestration of Network Slicing [9] proposals, extending the concept with inherent security as part of the closed loops [10], avoiding the typically too-late amendments to services when security has already been undermined.