# A Survey on Open Radio Access Networks: Challenges, Research Directions, and Open Source Approaches
## 6 Challenges and Future Research Directions
### Open RAN Field Issues
Other references have also discussed some defense mechanisms to increase software security in addition to these requirements and protocols, such as authentication and access control, cryptography, secure virtualization, anonymity and obfuscation, resilience assurance, lightweight security based on the physical layer, and intrusion detection mechanisms [103; 106; 110; 111]. SFG has also made modeling and analysis of security threats in the O-RAN architecture in [104]. SFG summarizes the threat surfaces, agents, potential vulnerabilities, and threats. Some parts of this analysis are also discussed by [112]. SFG specifies a total of 49 threats, divided into seven categories: threats to the O-RAN system, O-Cloud, open-source code, physical, 5G radio networks, and ML system threats. Focusing on the O-RAN system, there are 35 threats [104]. We will mention some of the main threats for each O-RAN component. A common threat to all the O-RAN components is the exploitation of insecure design, weak authentication, and weak access control in O-RAN components or network boundaries to compromise O-RAN components' integrity and availability. In the FH, the attacker could penetrate O-DU and beyond by accessing the O-FHI or targeting one or more planes in O-FHI. In O-RU, an attacker could set up a rogue O-RU. In Near-RT RIC, attackers could exploit xApps vulnerabilities or create malicious xApps. In Non-RT RIC, attackers could exploit rApps vulnerabilities or penetrate the Non-RT RIC to cause denial of service (DoS). Overload DoS attacks could also target SMOs. O-RAN TIFG has also provided some E2E Security Test Specification in [113]. From an E2E perspective, the O-RAN system is just another gNB. Therefore, any O-RAN standard adopter must follow security requirements, threats, and test cases outlined in 3 GPP TS 33.511 for gNB. Other than that, TIFG also specifies optional test cases for S-Plane, C-Plane, and Near-RT RIC A1 interface and O-Cloud. These test cases cover DoS, fuzzing, blind exploitation, and resource exhaustion attacks. Other references have identified some of these threats and attacks, such as data breaches, hijacking attacks, malicious insiders, data loss, DoS and distributed DoS (DDoS), abuse and nefarious use of services or resources, and caching attacks [103; 105; 110; 114]. Another method proposed to improve the network security is deploying zero trust architecture (ZTA) [115; 116; 102]. Integrating ZTA to 5G and 6G technologies has become critical in tactical and commercial applications [116]. ZTA is a solution to address security requirements in a network with unreliable infrastructure. ZTA has a dynamic risk assessment and trust evaluation as its key elements. Intelligent ZTA (i-ZTA), an AI-embedded ZTA, is proposed by [116] to provide secured information in unreliable network infrastructure. ZTA can provide necessary computational resources and seamless, reliable, and robust connectivity. Besides ZTA, another method proposed to deploy a secure Open RAN is called blockchain (BC). BC is a network system that can establish transactional faith among peer entities on decentralized peer-to-peer (P2P) platforms while overcoming the vulnerability of centralized ledger host [117]. BC has also emerged as a potential tool in designing a self-managed and scalable decentralized network [110; 117]. The BC technology has been discussed by many researchers in Open RAN along with its various potential application scenarios, including IoT, MEC, smart grid, vehicular network, and smart cities. BC can offer pseudonymity, one of the defense mechanisms to keep its users' privacy [118]. There are several main benefits if we integrated BC to Open RAN and its applications; one of them is reduced communication cost and reduced delay required to establish agreements facilitating a real dynamicity in RAN sharing [110; 117; 118]. However, incorporating BC into RAN still needs to be further studied.