# A Systematic Survey on 5G and 6G Security Considerations, Challenges, Trends, and Research Areas
## 3 5G Security Architecture: A Systematic Approach
### Radio Access Network
#### 3.2.5 O-RAN  
Open Radio Access Network (O-RAN) is a coalition in a new approach to creating a more open, modular, and configurable RAN in cellular networks. Historically, RANs were proprietary monolithic solutions that tied service providers down into choosing equipment from a limited amount of vendors, thus causing concern for constraints in options that are available to address the various demands of a wide variety of networks. These proprietary solutions resulted in a lack of interoperability, which sometimes severely impacted the network's cost, quality, and efficiency for service providers, as deployments of these solutions could be seen as vendor-locked solutions. Such vendor lock diminished the service providers' ability to respond to the network's different requirements at different geological areas due to varying customer usages and applications. Monolithic RANs also limited the amount of centralized control a service provider could exercise on network edge operations, and many control functions were encapsulated within the RAN components. O-RAN seeks to overcome the proprietary nature of the RAN, as well as the lack of central management, by dividing the RAN functionality into different functional elements with well-defined interfaces, thereby enabling the use of interoperable sub-units regardless of the original vendor. Furthermore, many of the functional components can now be realized as software elements and moved further away from the edge for a more centralized and agile RAN operation. Illustrated in Figure 8 are the components of an O-RAN compared  
Figure 7: Traditional repeater architecture in comparison with RIS-aided repeating/reflection architecture. to a traditional RAN setup based on a figure presented in [65]. It can be seen that O-RAN has introduced modular components in the RAN and also virtualization features that are referred to as O-vRAN (Open Virtualized RAN). In a white paper on the security benefits of O-RAN, the author shares how security is improved with an O-RAN architecture compared to traditional methods [66]. The author further reports on an incident in 2018 where major service provider networks were brought to a halt due to a specific vendor's proprietary software that utilized an expired certificate. With O-RAN, and its greater insight into the functional elements and its software-centric approach, it is likely that the issue would have been caught before a critical service outage occurred. The report concludes that O-RAN provides operators with more fine-grained control over the security of their networks and drastically reduces potential attack vectors that could result in the loss of service for the entire network by limiting its potential impact on parts of the network. While incidents such as this are rarely published, researchers at Nokia found that in 2022, at least 1/3 of surveyed cybersecurity professionals report eight or more breaches in a single category, including loss of funds, regulatory liability, theft of service, or service outage [67] related to 5G operations. This is further elevated as an area of concern given the fact that 5G services essentially rely on cloud services for many aspects of virtualized network functions. This means that there is a heightened risk of exposure to attacks from the web, which in 2018 accounted for 25% of all cyber incidents [68]. Configuration issues also compound the problem, as research has shown that 160,000 UPF interfaces were exposed to the web in 2023 [69]. As O-RAN allows for interoperability between software and hardware, there is a significant possibility that open-source software is employed for some of these functionalities. There has always been a discussion on whether open-source software is beneficial or detrimental to security efforts. Some corporations believe that releasing their code to the public increases the chance for malicious supply chain attacks, leading to the rise in demand for a Software Bill of Materials and illustrating the need for extensive code review and verification processes.