## 5 Proposed Framework
### ZTA Design
#### 5.1.3 Micro-Segmentation  
Our micro-segmentation framework is designed to provide defense-in-depth protection throughout the hierarchical architecture of the O-RAN. This architecture, as shown in Figure 4, strategically divides the network into distinct security zones, each with tailored security controls to ensure the integrity of components while maintaining the necessary operational flows. The key objective of this framework is to strictly isolate critical components of the system from potential threats, particularly from third-party applications or compromised parts of the network. This isolation is accomplished through a combination of stringent access control policies, secure communication protocols, and the real-time monitoring of system behaviors. \begin{table}
\begin{tabular}{l l l} \hline \hline
**Metric** & **Target** & **Achieved** \\ \hline False Accept Rate & \textless{}0.5\% & 0.12\% \\ False Reject Rate & \textless{}2\% & 1.3\% \\ Detection Latency & \textless{}20 ms & 8.5 ms \\ Throughput & 1000 authentications/s & 1250 authentications/s \\ \hline \hline \end{tabular}
\end{table} 
Table 7: Continuous authentication performance metrics [55]. Figure 3: Continuous authentication workflow: (1) API sequence analysis, (2) resource fingerprinting, (3) latency monitoring. Red boxes indicate anomaly detection points. The framework consists of three primary security zones: the Core Zone, the Controlled Zone, and the Quarantine Zone. Each zone represents a level of increasing protection, with security measures tailored to the specific role and risk associated with the components within it. The Core Zone is the most protected, containing the system's mission-critical components such as the SMO and RICs, which are essential for O-RAN's operation. These components are secured using robust security protocols such as mutual TLS 1.3, hardware-backed cryptographic keys, and regular re-authentication cycles, ensuring that only trusted communications are allowed. Furthermore, all control channels within this zone are encrypted using AES-256, with strict latency budgets to minimize exposure to real-time attacks. The Controlled Zone is designed to host third-party applications or xApps that interact with the O-RAN system but may not be as inherently trusted. For these components, we enforce Role-Based Access Control (RBAC) policies that ensure the principle of least privilege, limiting access to only those resources necessary for their function. To further enhance security, the interfaces through which these xApps communicate, namely the A1 and E2 interfaces, are rate-limited to prevent abuse, and all ML models used within these applications undergo cryptographic validation to ensure their integrity. Finally, the Quarantine Zone is designed to isolate suspicious or compromised components from the rest of the network. When a potential anomaly is detected, affected components are moved to this zone, where they are subject to stringent sandboxing techniques. This includes running the compromised components in isolated environments such as Docker containers, with read-only filesystems to limit the impact of any malicious actions. Additionally, network access to other critical interfaces such as O1 and O2 is blocked, preventing further lateral movement within the network. Forensic analysis is facilitated through full packet capture capabilities, which allow for the detailed examination of compromised components within a predefined analysis window. Security policy enforcement occurs across three architectural layers. At the Infrastructure Layer, hardware security modules (HSMs) are used to protect cryptographic keys, particularly in the Core Zone. The Platform Layer leverages Kubernetes network policies to enforce strict isolation between zones, ensuring that no unauthorized communication can occur between them.