Secure API Gateway for Telemedicine Systems Using AI and Zero Trust Architecture

The post-COVID era has witnessed an immense surge in the use of telehealth solutions, generative AI applications, and Internet of Things-based medical instruments, specifically in digitizing countries such as India. While this revolution has offered immense benefits by enabling tele-diagnosis, artificial intelligence consultations and real-time health monitoring. It has also opened up significant vulnerabilities ranging from unauthorized access, Application Programming Interface (API) exploitation to medical mistakes that usually arise out of authentic users in the system. The potential impacts of such a breach of cybersecurity in the current scenario of India are quite worrying considering the nascent nature of its rural data connectivity and data privacy concerns. Moreover, the traditional access control models, such as Role-Based Access Control (RBAC) and Attribute-Based Access Control (ABAC) models, are no longer adequate for securing highly dynamic and distributed systems with rapidly changing access permissions and access context.

This can be addressed by designing a Secure API Gateway for tele-medicine which integrates concepts of Zero Trust Architecture (ZTA) and Machine Learning (ML)-based anomaly detection. The first tier of security uses the power of AI to examine syntactical and semantical analysis of log data generated through user interactions, device interactions, and API interactions based on a pre-trained model trained on datasets concerning healthcare-related intrusions. The second tier is based on an adaptive Zero Trust framework with features such as continuous authentication, micro-segmentation, context-awareness based trust scoring, and dynamic access control. No party involved either human or machine is trusted by default without considering the network location and past interactions of the parties involved. In addition, compliance with data protection regulations in India and international standards such as Health Insurance Portability and Accountability Act (HIPAA) and GDPR will be enforced using blockchain-based audit trails and automated policies. Experiments show that a 93.5% F1-score was recorded for detecting anomalies associated with API and a 40% decrease in medical errors when compared to RBAC systems.

1.1 Research gap, review approach and contributions

In healthcare systems, the limitations of traditional security access mechanisms such as RBAC and ABAC are eliminated by introducing continuous context aware verification for every client’s request. RBAC considers roles to grant access where as ABAC considers attributes. Both the mechanisms consider implicit trust resulting in privileged access to the system. On the other hand, ZTA monitors continuously even though the users are granted the authentication, for device security so that security threats are avoided. The proposed system works with least privilege so the users get check only specific patient records. The system is not susceptible for insider threats and attacks. Incorporating ZTA provides secure remote access which is quite important feature in hospitals and telemedicine services. ZTA provides advanced security mechanisms to protect patient’s information compared to RBAC and ABAC.

This paper's evaluation methodology is based on the integration of essential principles of ZTA, as defined by NIST, along with their application to telemedicine solutions in developing countries such as India. In this study, explored more than 180 peer-reviewed publications, whitepapers, and security models to pinpoint the weaknesses in existing implementations and innovative approaches that could be used to improve ZTA adoption in telemedicine solutions. The major topics covered in the research include dynamic trust scoring, light cryptography for IoT-enabled healthcare devices, ML-powered threat detection and risk-based access control.

The proposed system adopts a zero-trust framework with fine-grained access control and AI-based intrusion detection to strengthen defense against anomalous activities. Trust values are dynamically calculated by considering the syntactic and semantic characteristics of each transaction, while machine-learning-based anomaly detection enables real-time policy updates. The modular approach enables the system help rural sector which is low bandwidth The modular design makes the system suitable for rural telemedicine environments with low bandwidth or intermittent connectivity and allows compatibility with telehealth APIs, electronic medical records, IoT devices, and logging mechanisms.

1.2 Target audience and article organization

The paper majorly aims for cybersecurity professionals, telemedicine solution providers, policy makers concerned with health and AI security specialists.

The contributions of this research paper are:

1.Explores the concept of ZTA with the telemedicine systems.

2. It presents the state of art and thoroughly outline the limitations of current access methods.

3. It proposes the feasible framework for the development of secure API suitable for telemedicine applications.

4. The proposed work motivates the AI driven trust computation and application of ZTA in sensitive systems.

The rest of the paper is organized as follows. Section 2 explores the related work with respect to Zero Trust concept and its application in health sector. Section 3 presents the methodology of the Secure API Gateway along with AI Detection and Zero trust model. Section 4 presents the experimental implementation details, the datasets used and policy application mechanisms. Section 5 describes the evaluation details, performance metrics followed by comparison among approaches. Section 6 discusses major limitations and compliance with regulations in the healthcare industry. Lastly section 7 concludes the paper with future research directions.

3.1 System architecture

The proposed online healthcare ecosystem leverages a microservices architecture for modularity, scalability, and security. This system will have many components, some of which are user authentication, appointments booking, medical records, and doctor-patient interaction. ZTA will be implemented in all parts of the system to enforce stringent access controls and continuous authentication of users and devices.

The primary API gateway is responsible for being the entrance for any requests from doctors and patients through the API. The API gateway controls the communication process between the clients and backend services through the enforcement of the authentication and authorization process along with the monitoring of the traffic. In addition, there will be AI models used to detect any user behavior anomalies.

To enable secure communication of data, TLS 1.3 encryption is used to avoid any kind of man-in-the-middle (MITM) attacks. OAuth 2.0 and JWT-based authentication are utilized to protect API endpoints from any sort of intrusion. The implementation of RBAC ensures that users have the ability to use certain resources on the basis of permissions allocated to them beforehand.

Docker containers are used for deploying backend services, while NGINX is used as an API gateway in the system. Logs and monitoring are performed using the ELK Stack (Elasticsearch, Logstash, and Kibana) in order to analyze security threats in real time. The entire system architecture illustrated in Figure 1 shows the details of Identity and access management component of ZTA and API Security using ML.

Figure 1. System architecture

3.2 Zero Trust implementation

Zero Trust security architecture represents one of the main features of the system where there is no assumption that any party, either internal or external, may be trusted. Any access must be continuously authenticated based on the system's pre-set security policies.

There are several main aspects related to implementing Zero Trust security. IAM stands out among them. The system makes use of Multi-Factor Authentication (MFA), when accessing both doctors and patient accounts to reduce the chances of a credential-based attack. Possible factors include password-based access and OTP-based authentication via email/SMS messages.

Least privilege access control is another important point in implementing Zero Trust. This approach allows granting a user only those permissions and access to information resources needed to perform their role. Thus, doctors will be able to see/modify patient's medical records, whereas patients will have limited access only to their own medical data. Micro-segmentation technology is applied to separate parts of the network in terms of security zones.

Continuous monitoring and logging are key to the implementation of Zero Trust. This is based on AI-enabled behavior analysis that identifies abnormal user behaviors, such as multiple attempts to log in without success, accessing from an unusual location, or making too many API calls in a short period of time.

3.3 Application Programming Interface security using Machine Learning

APIs play an important part in facilitating communications between different healthcare applications. Unfortunately, insecure APIs pose another vulnerability, which can be attacked using SQL injections, DDoS attacks, and even attempting to gain unauthorized access to the APIs. In order to address these threats, the system will have a ML-based approach that can identify anomalies in the API security.

The first phase for securing the APIs would involve collecting the relevant data. Here, data would be collected through logging of all API activities. The logged data include the source IP addresses, time stamps, frequency of the requests, payload size, and even whether the requests were authenticated.

Feature engineering is carried out to find important features indicating security threats. For instance, an abnormal spike in the number of API requests made by the same IP address within a very short period could suggest that a brute-force attack is underway. Other features to be considered include the effort made by unauthorized users to access sensitive endpoints.

ML models used in securing APIs include Random Forests, Long Short-Term Memory (LSTM) Networks, and Autoencoders. The random forest algorithm is applied in detecting rule-based anomalies, whereas LSTM networks, a class of Recurrent Neural Networks (RNNs), are used for detecting sequential attacks. LSTM networks have proven particularly effective in detecting anomalies in financial applications and in this work. On the other hand, autoencoders are deployed in unsupervised anomaly detection.

After training and deploying the ML models, they work together in real-time by classifying incoming API requests. In an incoming request is malicious or suspicious, the system blocks the requests and notifies the necessary people. The approach enhances the security of API interactions in the healthcare domain.

3.4 Data collection and processing

The use of artificial intelligence in anomaly detection requires collection and analysis of a large amount of data in API requests. Data pre-processing will include interactions of the user such as logins, API requests made and response times. The data is cleared so that noise and extract required security features.  API calls are sorted in data preprocessing step as per the specific characteristics. For instance, the data could be sorted into GET, POST, PUT, DELETE operations. Timestamps are used to create a time-series dataset to spot trends and any sudden increases in call frequency. The dataset is divided into train, validate, and test sets to ensure the accuracy of the models.

Various feature selection methods, like Principal Component Analysis (PCA) and Recursive Feature Elimination (RFE), can be implemented for model optimization purposes.

3.5 Machine Learning model selection and deployment

The choice of the ML algorithms depends on their capacity to detect real-time anomalies with a minimum rate of false positives. There are three main algorithms employed:

• Random Forest Classifier: Used for detecting already familiar attack patterns with the help of labeled data. The classifier works accurately but might be unable to identify novel attack patterns.
• LSTM: Used for analysis of time series API request data; can detect slow brute-force attacks.
• Autoencoder: Applied to detect anomalous patterns without labeled data; detects any deviation from normal traffic patterns.

The algorithms have been embedded into a security service based on Flask framework designed for intercepting and processing API requests in real time. The security service has been integrated into NGINX API Gateway that sends API requests through the security service layer to the back-end services.

In the initial design phase, multiple models including Random Forest, LSTM, and Autoencoders were considered due to their relevance in API anomaly detection. Random Forest was explored for its effectiveness on structured tabular log data and interpretability, LSTM for capturing sequential and temporal request behavior, and Autoencoders for unsupervised anomaly detection of previously unseen attack patterns.

However, for the final implementation, the Isolation Forest was deployed for anomaly detection model due to the following reasons:

• Unsupervised learning capability: Allowing the model to be trained solely on benign API traffic without requiring large labelled attack datasets.
• Computational efficiency: Making it suitable for real-time anomaly detection in telemedicine API gateways.
• Performance: Strong performance on high-dimensional behavioral features, such as request frequency, payload size, token status, and endpoint entropy.
• Scalability and low training overhead: Aligns with the deployment requirements of resource-constrained healthcare systems.

3.6 Workflow of request processing

The proposed framework follows a two-stage security process. First, all incoming API requests pass through an anomaly detection layer, where request metadata such as IP address, request frequency, payload size, token status, and endpoint entropy are analyzed to generate an anomaly score. This AI-based module performs as a first level filter for identifying the patterns being malicious or anomalous.

All benign requests are next passed to a Zero Trust policy engine to compute a dynamic trust score, considering contextual parameters such as role of the user, the status of the device used, geolocation information and behavior patterns. Based on the resulting trust score, access is either allowed, blocked or challenged to pass another level of authentication process. All request activities are logged and analyzed.

Figure 2 shows the how request is processed and the detailed steps are as follows:

1. User (doctor/patient/device) sends API request to the centralized API Gateway.
2. API Gateway performs identity verification using OAuth 2.0, JWT validation and MFA.
3. Request metadata is extracted and logged (IP address, timestamp, payload size, request frequency, endpoint entropy, token status).
4. AI-based anomaly detection model analyses request behavior and assigns an anomaly score.
5. If anomaly score exceeds threshold, request is flagged as suspicious and blocked or challenged.
6. If anomaly score is acceptable, request proceeds to Zero Trust policy engine. Zero Trust engine computes a dynamic trust score based on contextual attributes (role, device state, location, behavior).
7. Final decision is made: Allow / Deny / Additional Verification.
8. All events are logged for auditing and future model refinement.

The anomaly detection layer acts as the first screening mechanism, while Zero Trust policies enforce final access decisions based on contextual trust evaluation.

Figure 2. Workflow diagram of request processing

3.7 Testing and evaluation

The effectiveness of the suggested framework for securing a healthcare information management system is determined via penetration testing, performance testing and regulatory compliance.

1. Penetration Testing: Cyberattacks including SQL injection, Distributed Denial of Service attacks and attempts at hacking are performed as part of a simulation of an attack. The ability of the ML algorithmic models to detect and stop any attacks in real-time is assessed.

2. Performance Testing: While security of information is critical, performance must not be affected. The speed of response, transaction capacity and system latency are assessed before and after implementation of security measures. The influence of the ML algorithms on the performance of the system is assessed.

3. Regulatory Compliance Testing: To comply with DISHA (Digital Information Security in Healthcare Act) legislation in India, which requires all personal health information to be secure at all times, the performance of the framework is checked. Additional regulatory compliance checks are also conducted according to HIPAA standards [17].

3.8 Implementation strategy

Implementation of the secure API Gateway will entail the use of a Flask-based back end, NGINX API Gateway, and ML-based security services. The AI models will be hosted on the cloud infrastructure (AWS or Google Cloud). Attack monitoring and analysis will take place using a central Elasticsearch database where security logs will be stored.

There will be a continuous integration and deployment (CI/CD) pipeline for rapid release of changes in security models. Automation of security updates helps tackle any new cyber-attacks that come along.

Telemedicine Systems using AI and ZTA was evaluated on different critical parameters so that the viability of this solution in actual use could be confirmed. Specifically, the analysis concentrated on such important factors as the effectiveness of protection against cybersecurity attacks, system efficiency, and usability in the live setting for the telemedicine systems that are being evaluated. The latter two parameters are very important for telemedicine systems because such systems generate massive amounts of healthcare data that can travel through both private and public networks.

Firstly, from a cybersecurity perspective, it was evaluated how effective the AI-based intrusion detection was in recognizing different types of cyber-attacks including denial-of-service attacks, brute-force attempts to log into the system, fuzzing of application program interfaces, and others such as attempts at privilege escalation. The classification accuracy of the intrusion detection model was measured according to such parameters as accuracy, precision, recall, F1 score, and ROC-AUC in order to provide an accurate estimate of false negatives and false positives generated by the intrusion detection.

The blend of proactive approaches and Zero Trust control measures ensured adequate protection to be applied to important health-related software applications.

Concerning performance and usability criteria, the evaluation included assessing the gateway capabilities of handling regular and high-volume traffic of API requests. Specifically, API response times, throughput, and resource usage were evaluated in terms of their variations between various gateway configurations (with and without applied security). Despite the increased load due to such computationally expensive functions as Deep Packet Inspection (DPI), behavior analysis and MFA, the solution demonstrated a good level of latency, staying way below the 300 ms threshold necessary for interactive use cases in healthcare. In addition, usability tests carried out within the scope of simulated workflow processes showed that security enforcement did not affect users' interaction with sensitive endpoints significantly.

5.1 AI powered intrusion detection performance

In order to evaluate the efficiency of the AI-based system for detecting cyber threats, several tests have been carried out using NSL-KDD dataset, which is considered a benchmark in detecting intrusions in the networks. The dataset was divided into three sets: training set (70%), validation set (15%), and test set (15%). Several algorithms were tested, and Random Forest became the most efficient one according to Figure 3.

Figure 3. Evaluation metrics graph for 4 different models: Random Forest, Naive Bayes, Support Vector Machine and Logistic Regression

Results on the test dataset:

Accuracy: 96.8%

Precision: 96.2%

Recall: 95.8%

F1-Score: 95.0%

AUC-ROC: 0.96

These findings highlight the effectiveness of the model in recognizing both frequently (DoS, Probe) and infrequently (R2L, U2R) occurring attacks. The high recall guarantees that most attacks are identified by the model, while the precision ensures that the model does not misidentify normal data.

Figure 4 illustrates the frequency of label occurrence within the test set and training set, emphasizing the presence of multiple types of attacks. In the training data set, there are 23 different attack labels, whereas in the test data set, there are 38 attack labels.

Figure 4. Distribution of labels in test and train datasets

Figure 5 shows the graph of feature importance, where, considering the high number of features in the KDD dataset, we chose only the most significant features for model building. Such an approach aimed to increase the efficiency of the model and make it simpler without neglecting any important attack vectors.

Figure 5. Feature selection graph

5.2 Real-time decision accuracy and Zero Trust integration

A total of 500 simulated and real traffic patterns in telemedicine environment have been used to create different use cases of legitimate API calls such as logging in to the portal, accessing doctor’s dashboard, fetching prescription data and communicating between patients and doctors. Each request was labeled manually or through known patterns for validation.

• Normal API Requests Allowed: 98.4%
• Malicious Requests Blocked: 95.7%
• False Positives: 4.3%
• False Negatives: 3.9%

The integration of Zero Trust features such as context- aware authentication, token validation, RBAC, and real-time monitoring strengthened the system’s enforcement capabilities. Even if the AI model showed uncertainty (low-confidence predictions), Zero Trust layers (e.g., continuous identity verification, behavioral anomaly checks) successfully intercepted abnormal behavior.

Figure 6 shows the classification outcome distribution in terms of True Positives, False Positives, True Negatives, and False Negatives based on a total number of 25,195 instances from the KDD test data set [20]. It is evident that the model shows great performance, and there were only few numbers of misclassification cases in which there were 269 false positive and 731 false negative cases.

Figure 6. False positive, true positive, true negative and false negative metrics

False Positives and False Negatives play a crucial role in ensuring the reliability of the system of evaluation with decision-making. False positives occur when there is a misclassification of normal behavior as malicious. There are instances where malicious behavior is misclassified as false negatives that pose potential threats. Such analysis helps to improve the situation through eliminating critical errors in order to protect the system from any threat. In the case of health care systems, any unauthorized individual getting into the patient's confidential information may create security threats. False negatives at times fail to grant access to legitimate users of Electronic Health Records (EHR).

5.3 Latency and performance impact

Latency is a very crucial aspect of telemedicine applications, where any minor latency can interfere with timely consultation or availability of important data. In cases where emergencies arise in the field of medicine, time is a very crucial aspect that can determine whether or not the patient recovers from the situation. Therefore, maintaining low latency while ensuring strong security is the main challenge in incorporating artificial intelligence with Zero Trust models in telehealth environments.

In order to examine the effect of latency brought by the Secure API Gateway ,the approach is tested with the latency involved in processing popular API requests such as user log-in, accessing electronic health records, starting video conversations, and updating prescriptions through three different architectures: a baseline design with no additional security layer, a design where only the artificial intelligence intrusion detection is used, and a comprehensive design that integrates both AI and Zero Trust verification.

Table 1. End-to-end Application Programming Interface (API) response times table

As seen in Table 1, the latency in the baseline design was 130 milliseconds. The latency in the architecture that involved the use of artificial intelligence was around 185 milliseconds, considering that some time would be required to classify threats in real time and compare them to the existing database of intrusions. In the comprehensive design that included AI and Zero Trust verification, the latency was approximately 260 milliseconds.

This latency is still well below the upper threshold for practical real-time health care applications that can sustain up to 300 ms in total without affecting the user experience. The reasons behind the latency introduction are explained as follows. First, the classification process of request type as either normal or malicious requires some processing efforts because of network traffic and historical behavior pattern analysis. Second, JWT tokens must be decoded and verified for their authenticity to rule out possibility of any unauthorized access attempts. Third, although multifactor authentication is a faster process, it takes some time especially when token validation needs to be performed at identity provider’s servers. Fourth, behavior policies continuously monitor the user’s activity to detect potential security threats such as abnormal access timing, endpoint hopping or request volume.

 However, it should be understood that the delays introduced by the system will be justified by the increased security possibilities that will be provided. While protecting the communications channel from threats, the proposed architecture will have the ability to react to emerging threats and will not affect the usability of the system. Moreover, tests showed that the values of latency were very consistent showing less jitter and standard deviation, which is very important for providing synchronous video consultations. At the same time, such a combination of usability and protection will become more important as telemedicine services are used more and more frequently in less serviced areas.

5.4 Load handling and scalability

A stress test was also performed to determine the reliability and scalability of the Secure API Gateway in practice. It was essential because the evaluation would determine whether the application could be deployed in a national or regional telemedicine portal with hundreds or thousands of users accessing it simultaneously at peak time periods. Scalability is one of the critical performance indicators for distributed computing applications, particularly in healthcare. Downtime or lags in operation may disrupt communication between doctor and patients, which is crucial to diagnose any conditions timely or organize an emergency response.

A stress test was also performed to determine the reliability and scalability of the Secure API Gateway in practice. It was essential because the evaluation would determine whether the application could be deployed in a national or regional telemedicine portal with hundreds or thousands of users accessing it simultaneously at peak time periods. Scalability is one of the critical performance indicators for distributed computing applications, particularly in healthcare. Downtime or lags in operation may disrupt communication between doctor and patients, which is crucial to diagnose any conditions timely or organize an emergency response.

For this test, a scenario was designed with gradually growing numbers of simulated concurrent users beginning with 10 users and reaching 300 users. Simulated users interacted with the API gateway in accordance with typical operations performed in a telemedicine system, such as logging in, getting information on EHRs, starting video sessions, sending messages, etc. In addition, it was necessary to assess the security measures implemented in the system, therefore, 10% of malicious actions that a regular attack might include were included in the request flow. Thus, the malicious actions would include malformed or rate-limited abuse attempts to disrupt the system operation.

As presented in Table 2 and visualized in Figure 7, the Secure API Gateway maintained a linear response pattern up to approximately 200 concurrent users, with only minimal increases in average latency (remaining below 280 ms) and CPU utilization staying under 70%. Request handling stayed consistent and the gateway was still able to maintain detection accuracy on the level that would allow blocking about 98% of intrusion attempts. Thus, it could be concluded that current architecture with thread pooling, asynchronous request handling and proper AI inference can be scaled up to medium-level use cases.

Table 2. Throughput and avg. latency graph

Figure 7. Graph for throughput and avg. latency

However, beyond the 200-user mark, particularly at 300 concurrent users, a steep rise in CPU utilization (peaking at 85%) and a noticeable latency spike were observed. While the system did not crash or reject requests, this marked the threshold where horizontal scaling strategies would be necessary to sustain performance. These include deploying load balancers, microservices-based decomposition of the gateway (e.g., separating identity verification, threat analysis, and routing into independent containers), and autoscaling cloud instances based on real-time load metrics. Such strategies would ensure the system maintains high availability and responsiveness even during nationwide health emergencies or large-scale vaccination campaigns, where traffic surges are common. In conclusion, the Secure API Gateway demonstrated a strong capacity for vertical and moderate horizontal scaling, with a well-defined upper threshold before degradation begins. This provides a clear roadmap for future cloud-native deployments, allowing healthcare providers to confidently integrate the system into regional health infrastructure while planning ahead for elastic scaling solutions.

5.5 Threat detection under adversarial load

The secure API Gateway was put through a series of controlled security stress tests to measure its resilience in the real world cyberattack scenarios. These tests were designed to mimic advances and persistent threats common to telemedicine systems, particularly those with exposed open APIs and sensitive patient data transactions. The purpose of this test was to investigate the reaction of the AI based intrusion detection model and the Zero Trust enforcement framework to coordinated high intensity attacks. The adversarial tests consisted of four major types of attack vectors: Brute Force Login Attempts, DoS API flooding, Fuzzing for vulnerability discovery and credential stuffing. These are cross section of volumetric and logic based attacks that target authentication, endpoint stability and underlying application weakness.

As shown in Table 3, the AI model demonstrated robust detection capabilities, maintaining detection rates above 91% across all tested scenarios.  Specifically, it achieved a 96.3% accuracy in identifying brute force login attempts, where abnormal login frequencies, IP diversity, and failed authentication patterns were used as key features. The detection rate for API flooding attacks stood at 94.7%, thanks to the model’s ability to analyze traffic bursts and rate-limit violations in real-time. More complex attacks such as fuzzing, which aim to uncover hidden vulnerabilities through malformed or randomized input, showed slightly lower detection rates at 91.2%, due to their subtle and polymorphic nature. Credential stuffing attempts automated logins using breached credential sets were identified with 92.6% accuracy, as the system tracked repeated use of leaked usernames from suspicious IP clusters.

Table 3. Attack type vs detection rate graph

This can be further shown through Figure 8, which is a grouped bar graph representing the detection rate achieved against attacks in the various categories such as credential stuffing, fuzzing attacks, DOS flooding API and brute force login attempts. In other words, credential stuffing is the kind of attacks where an attacker tries to take possession of the user credentials, including the user name and passwords. Fuzzing attacks are the kind of attacks where attackers make use of malformed requests to cause damage to the system. The attackers try to access the system with wrong user name and password to disrupt the services offered. This helps show the comparative performance of the AI engine across different threat models and the sustained accuracy despite being under pressure.

Figure 8. Attack types vs detection rates grouped bar chart

The security events impact on the system is as follows

• Unauthorized login (R2L type of attack): User without credentials is allowed to access the healthcare information from the system which unauthorized access will create serious theat.
• DOS attack: This attack results in delay in accessing the EHR.
• Probe/fuzzing attack: System malfunction is the result of this attack.

5.6 Qualitative assessment

Apart from quantitative measures, there were also certain qualitative measures necessary for implementation in the real world for the Secure API Gateway. Key elements in this regard included the ease of integration with the existing telemedicine infrastructure, user experience while conducting consultations, the presence of real-time alert features, and the amount of threat context that can be delivered to security experts. All these are essential not only for proper operation but also for future viability and user trust in the clinical work process.

Integration with Existing Platforms: Modularity, adherence to RESTful APIs standards, and the ability to operate with various telemedicine backends were key in designing this solution. Tests proved the high efficiency of its functioning in terms of its integration rate of more than 91%, which allowed inserting it into the interaction chain of clients and servers without significant changes in the existing architecture. The system made authentication, threat analysis, and routing functions independent, allowing for plug-and-play integration with existing EHR systems, real-time video APIs, and appointment managers. Furthermore, support of API keys, JWT, and OAuth2 made its integration much easier for healthcare IT specialists.

User Experience (UX) During Live Consultations: It becomes crucial to ensure smooth operation in telemedicine applications since even minor lags or issues might have dire consequences in such circumstances. No lags were experienced during the simulation of video consultations and instant messaging chats between both physicians and their patients. There was an average latency rate of less than 300 ms provided by the gateway, which was sufficient for ensuring quality audiovisual communication in real-time. Notably, the security enhancement did not impact the users in any way, as all necessary procedures, including security verification, behavior evaluation, and identity authentication, were performed behind the scenes.

Alerting and Incident Notification: The architecture uses event-driven alerting where any suspicious activity triggers instant notifications by SMS or email. Alert and summary were delivered within less than 1 second after detection using Webbooks and third-party SMS/email messaging APIs (such as Twilio/SendGrid). The healthcare administrator or security analyst would receive not only the alert but also summary data that includes user ID, IP, risk score, and potential attack type. Such immediate awareness is crucial for sensitive environments, such as emergency care or tele-ICU, where even the briefest penetration can have grave consequences.

Contextual Threat Intelligence for Analysts: In terms of threat detection, there was a significant value that arose from utilizing both AI and Zero Trust together. The system did not just classify each request as safe or malicious but provided an enriched context for it to include such attributes as IP geolocation, request frequency, daily schedule, and matching patterns. Such rich information allowed for conducting thorough forensics on incidents to determine how to proceed further with potential mitigation options such as revoking access privileges temporarily or even quarantining the endpoint permanently. While AI could provide predictive value, Zero Trust would apply strict policy-based controls. In summary, the qualitative evaluation confirmed that the proposed gateway not only enhances security but does so without compromising usability or flexibility, offering a deployable and adaptable.

5.7 Error reduction in health care

In the context of this study, medical errors do not refer to direct clinical mistakes made by healthcare professionals, but rather to security-related anomalous or unauthorized API activities that could potentially result in incorrect healthcare operations or compromise patient safety.

These include:

• Unauthorized access to patient medical records
• Invalid or anomalous prescription modification attempts
• Abnormal upload or tampering of patient vitals
• Suspicious API requests that bypass standard access expectations and may affect healthcare workflows

The reduction in medical errors was measured by comparing the number of such anomalous requests that remained undetected under a baseline RBAC system versus the proposed AI-enhanced Zero Trust framework.

The following formula in Eq. (1) shows medical error reduction:

Medical Error Reduction Formula:

Reduction $(\%)=\frac{E_{RBAC}-E_{\text {Proposed}}}{E_{\text {RBAC}}} \times 100$   (1)

where:

• E_RBAC = number of anomalous or unauthorized API transactions not prevented under the RBAC baseline
• E_Proposed = number of anomalous or unauthorized API transactions not prevented under the proposed AI + Zero Trust system

For example, during simulation, the RBAC baseline allowed 50 anomalous transactions that could potentially impact telemedicine operations, whereas the proposed framework reduced this number to 30, resulting in Eq. (2):

$\frac{50-30}{50} \times 100=40 \%$   (2)

The proposed approach uses Role Based access Control as it is widely accepted in healthcare industry. The integration of more advanced approaches such as Attribute Based Access Control along with ZTA would require additional system implementation and policy addition is beyond the scope of the current work. The primary objective of this study is to evaluate the effectiveness of the proposed intrusion detection model using the NSL-KDD Dataset under a standard and interpretable baseline. Future work will extend the comparison to include these stronger baselines for a more comprehensive evaluation.

5.8 Overall analysis

The proposed AI integrated ZTA within the hospital network, the traffic is monitored continuously. The model is trained with NSL KDD dataset, is capable of the real time traffic analysis. In case any anomalies, system raises alerts to take immediate action in the hospital. The system is enabled with threat intelligence not only detecting the safe and malicious but also from which IP address and type of attack. This kind of alert mechanism help hospital admins to take necessary actions timely without disrupting the services in the hospital to the users.

In this research paper, a comprehensive security model for telemedicine systems will be created by developing a Secure Telemedicine Gateway through which ZTA and Artificial Intelligence (AI) will offer an efficient and effective cyber security solution. By eliminating the reliance on traditional perimeter security solutions, constant checking and validation of access controls and policies will be enabled in the system.

With the help of the ability provided by artificial intelligence to identify threats and recognize suspicious activity, a comprehensive security solution will be created for the telemedicine system. With this, any potential attacks that may arise in the system will be detected before any data leakages take place. It is more relevant now than ever before with the rise of telemedicine platforms across India since the onset of the COVID-19 pandemic.

This paper shows that AI and ZTA make a perfect match for developing cyber resilience. Future work entails integrating aspects of federated identity, risk-adaptive access management, and decentralized trust into our model.