# Open Radio Access Networks For Smart IoT Systems: State of Art and Future Directions
## 4 Challenges and Future Research Directions
### Challenges
#### 4.1.4 Security and Privacy  
O-RAN has a core networking infrastructure to support smart IoT systems, but the significance of the security and privacy of the system and its data cannot be overemphasized. There are inherent layer-wise IoT security and O-RAN privacy concerns, which can be transferred to the O-RAN for IoT systems. For instance, by launching denial of service (DoS) attacks on communication channels between the IoT system and O-RAN, adversaries can disrupt the network established by the network protocols and prevent communication between the two systems. Additionally, O-RAN, as a new architecture, opens an additional vulnerability interface, which has left the research community with questions such as the following: _What are the security vulnerabilities to be realized from the emerging system? How do we deal with such vulnerabilities to lead to trustworthy security of O-RAN systems for IoT applications?_  
As evident from the previous sections, supporting IoT systems with O-RAN will yield several promising benefits in terms of automation, cost savings, and interoperability while increasing the system's attack surfaces, i.e., exposing the resulting system to several security threats that need to be taken care of to ensure the integrity, confidentiality, and availability of the connected devices and data. Considering the sensing unit, for example, adversaries can spoof the system to gain unauthorized access, thereby corrupting the data generated by the sensing unit with the aid of malicious codes, hardware Trojans, etc., or launch DoS/DDoS attacks by depleting the batteries of the narrow-band IoT sensing devices to make their services unavailable as well as acting as a man in the middle (MITM) between the industrial controllers among others. The processing unit is responsible for cleaning, filtering, and aggregating the data generated using the networked edge/cloud computing infrastructure that can provision data-driven ML/AI models to assist system security. In this unit, the adversaries can launch attacks that hinder the integrity and availability of the generated data, for example, a jamming attack (damaging the data using irrelevant signals), a hijacking attack that renders the services unavailable, or a social engineering attack by misguiding the unit stakeholders. The literature has recorded several attacks targeting the protocols, transmission channels, and standards used by the traditional communication unit. However, the O-RAN-based communication unit is exposed to new versions of attacks targeting each layer of the O-RAN setting. The non-RT-RIC guides and orchestrates the RAN using data-driven policies deployed on containerized rApps, while the N-RT-RIC executes the policies with the aid of the containerized xApps. Under openness in the system, adversaries can inject malicious codes into the rApps/xApps as a backdoor or adversarial examples to destabilize the system's operation by compromising the guiding data or the model. The existence of different xApps/rApps, as demonstrated in Figure 4, can result in several conflicts while achieving the interoperability goal. Adversaries can leverage this loophole to misconfigure and disrupt the decisions made by the operating apps or the radio resource management, for example, to degrade the system's performance or even trigger DoS attacks that will shut down the RIC. The disaggregated components (CU, DU, RU) serve as another attack target: network functions deployed on the cloud expose the system to internal and external attacks. On the path to enabling interoperability, the open interfaces expose the system to several threats like MITM, DoS, radio jamming, etc., which are targeted towards the different levels of communication units. The services unit integrates the preceding processes from the previous units to yield an effective, efficient operating environment for the users.