{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,7,22]],"date-time":"2026-07-22T16:09:42Z","timestamp":1784736582322,"version":"3.55.0"},"reference-count":149,"publisher":"Institute of Electrical and Electronics Engineers (IEEE)","license":[{"start":{"date-parts":[[2025,1,1]],"date-time":"2025-01-01T00:00:00Z","timestamp":1735689600000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/legalcode"}],"funder":[{"DOI":"10.13039\/501100000038","name":"National Natural Sciences and Engineering Research Council of Canada (NSERC) through Research","doi-asserted-by":"publisher","award":["RGPIN2025-07140"],"award-info":[{"award-number":["RGPIN2025-07140"]}],"id":[{"id":"10.13039\/501100000038","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["IEEE Open J. Commun. Soc."],"published-print":{"date-parts":[[2025]]},"DOI":"10.1109\/ojcoms.2025.3644132","type":"journal-article","created":{"date-parts":[[2025,12,15]],"date-time":"2025-12-15T18:40:49Z","timestamp":1765824049000},"page":"10465-10495","source":"Crossref","is-referenced-by-count":8,"title":["Integrating Zero Trust Architecture in O-RAN: A Comprehensive Survey and Analysis"],"prefix":"10.1109","volume":"6","author":[{"given":"Ali","family":"Mehrban","sequence":"first","affiliation":[{"name":"Énergie Matériaux Télécommunications Research Centre, Institut National de la Recherche Scientifique, Centre Énergie, Matériaux, et Télécommunications (INRS-EMT), Montreal, QC, Canada"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-2893-1101","authenticated-orcid":false,"given":"Zakaria","family":"Abou El Houda","sequence":"additional","affiliation":[{"name":"Énergie Matériaux Télécommunications Research Centre, Institut National de la Recherche Scientifique, Centre Énergie, Matériaux, et Télécommunications (INRS-EMT), Montreal, QC, Canada"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Hajar","family":"Moudoud","sequence":"additional","affiliation":[{"name":"Département d’informatique et d’ingénierie, Université du Québec en Outaouais, Gatineau, QC, Canada"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-3577-6530","authenticated-orcid":false,"given":"Long","family":"Bao Le","sequence":"additional","affiliation":[{"name":"Énergie Matériaux Télécommunications Research Centre, Institut National de la Recherche Scientifique, Centre Énergie, Matériaux, et Télécommunications (INRS-EMT), Montreal, QC, Canada"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"263","reference":[{"key":"ref1","volume-title":"Overview of the O-RAN ALLIANCE","year":"2020"},{"key":"ref2","volume-title":"O-RAN: Towards an Open and Smart RAN","year":"2018"},{"key":"ref3","doi-asserted-by":"publisher","DOI":"10.1016\/j.jnca.2023.103621"},{"key":"ref4","doi-asserted-by":"crossref","DOI":"10.6028\/NIST.SP.800-207","article-title":"Zero trust architecture","author":"Rose","year":"2020"},{"key":"ref5","first-page":"1921","article-title":"ORANalyst: Systematic testing framework for open RAN implementations","volume-title":"Proc. 33rd USENIX Secur. Symp.","author":"Yang"},{"key":"ref6","volume-title":"Open RAN: Attack of the xApps","year":"2023"},{"key":"ref7","volume-title":"Zero Trust Architecture (ZTA) for Secure O-RAN","year":"2024"},{"key":"ref8","volume-title":"Cybersecurity of 5G Networks: EU Toolbox of Risk Mitigating Measures","year":"2020"},{"key":"ref9","volume-title":"Report on How Virtualization Technologies Can Be Used to Promote Security and Reliability in 5G Networks: Communications Security, Reliability and Interoperability Council (CSRIC) VIII\u2013Working Group 2","year":"2022"},{"key":"ref10","volume-title":"Zero Trust Architecture for Evolving Radio Access Networks","author":"Jardal","year":"2023"},{"key":"ref11","doi-asserted-by":"publisher","DOI":"10.1109\/tmc.2024.3393430"},{"key":"ref12","doi-asserted-by":"publisher","DOI":"10.1109\/access.2024.3408690"},{"key":"ref13","doi-asserted-by":"publisher","DOI":"10.1109\/mnet.2024.3434419"},{"key":"ref14","doi-asserted-by":"publisher","DOI":"10.1109\/ojcoms.2025.3526215"},{"key":"ref15","doi-asserted-by":"publisher","DOI":"10.1109\/ojcoms.2024.3430823"},{"key":"ref16","doi-asserted-by":"publisher","DOI":"10.1109\/comst.2025.3562429"},{"key":"ref17","doi-asserted-by":"publisher","DOI":"10.32604\/cmes.2024.052394"},{"key":"ref18","doi-asserted-by":"publisher","DOI":"10.1109\/icc51166.2024.10622553"},{"key":"ref19","doi-asserted-by":"publisher","DOI":"10.1109\/globecom54140.2023.10437043"},{"key":"ref20","doi-asserted-by":"publisher","DOI":"10.1109\/infocomwkshps61880.2024.10620803"},{"key":"ref21","doi-asserted-by":"publisher","DOI":"10.1109\/iwcmc65282.2025.11059720"},{"key":"ref22","doi-asserted-by":"publisher","DOI":"10.1109\/iwcmc65282.2025.11059692"},{"key":"ref23","doi-asserted-by":"publisher","DOI":"10.14722\/futureg.2025.23099"},{"key":"ref24","doi-asserted-by":"publisher","DOI":"10.1016\/j.comnet.2025.111450"},{"key":"ref25","doi-asserted-by":"publisher","DOI":"10.1109\/ICIT64950.2025.11049094"},{"key":"ref26","doi-asserted-by":"publisher","DOI":"10.1049\/icp.2024.2238"},{"key":"ref27","doi-asserted-by":"publisher","DOI":"10.3390\/fi17060233"},{"key":"ref28","doi-asserted-by":"publisher","DOI":"10.1109\/mwc.001.2300419"},{"key":"ref29","volume-title":"Open RAN threat analysis of the O-RAN SC reference implementation","author":"Wittemeier","year":"2024"},{"key":"ref30","volume-title":"Open RAN: Attacks against mobile operators from the outside in practice","author":"Dudek","year":"2024"},{"key":"ref31","doi-asserted-by":"publisher","DOI":"10.1109\/comst.2025.3598406"},{"key":"ref32","doi-asserted-by":"publisher","DOI":"10.1109\/lnet.2024.3514357"},{"key":"ref33","doi-asserted-by":"publisher","DOI":"10.3390\/app12010408"},{"key":"ref34","doi-asserted-by":"publisher","DOI":"10.1007\/s11277-020-07231-3"},{"key":"ref35","doi-asserted-by":"publisher","DOI":"10.1002\/9781119886020"},{"key":"ref36","doi-asserted-by":"publisher","DOI":"10.1002\/9781119847083"},{"key":"ref37","doi-asserted-by":"publisher","DOI":"10.1109\/comst.2014.2355255"},{"key":"ref38","volume-title":"5G New Radio: Fundamentals, Procedures, Testing Aspects","year":"2020"},{"key":"ref39","doi-asserted-by":"publisher","DOI":"10.1109\/comst.2018.2868805"},{"key":"ref40","volume-title":"O-RAN Fronthaul Working Group Control, User and Synchronization Plane Specification","year":"2021"},{"key":"ref41","doi-asserted-by":"publisher","DOI":"10.1587\/transfun.e101.a.374"},{"key":"ref42","doi-asserted-by":"publisher","DOI":"10.1109\/mcom.2015.7355588"},{"key":"ref43","doi-asserted-by":"publisher","DOI":"10.1109\/mcom.2016.1600140cm"},{"key":"ref44","volume-title":"O-RAN: Towards an open and smart RAN","year":"2019"},{"key":"ref45","doi-asserted-by":"publisher","DOI":"10.1016\/j.comnet.2020.107516"},{"key":"ref46","doi-asserted-by":"publisher","DOI":"10.12785\/ijcds\/1601111"},{"key":"ref47","doi-asserted-by":"publisher","DOI":"10.1109\/mcom.2014.6898939"},{"key":"ref48","doi-asserted-by":"publisher","DOI":"10.1002\/9781118188545"},{"key":"ref49","article-title":"Understanding O-RAN: Architecture, interfaces, algorithms, security, and research challenges","author":"Polese","year":"2022","journal-title":"arXiv:2202.01032"},{"key":"ref50","volume-title":"Open RAN functional splits","year":"2021"},{"key":"ref51","doi-asserted-by":"publisher","DOI":"10.1109\/comst.2018.2841349"},{"key":"ref52","article-title":"Study on new radio access technology: Radio access architecture and interfaces, version 14.0.0","year":"2018"},{"key":"ref53","volume-title":"Low latency QoS design for 5G solution juniper validated design (JVD)","year":"2024"},{"key":"ref54","doi-asserted-by":"publisher","DOI":"10.6028\/nist.sp.800-162"},{"key":"ref55","volume-title":"Zero Trust Networks: Building Secure Systems in Untrusted Networks","author":"Gilman","year":"2017"},{"key":"ref56","doi-asserted-by":"publisher","DOI":"10.1109\/access.2022.3174679"},{"key":"ref57","doi-asserted-by":"publisher","DOI":"10.1155\/2022\/6476274"},{"key":"ref58","doi-asserted-by":"publisher","DOI":"10.1016\/j.csi.2024.103832"},{"issue":"3","key":"ref59","first-page":"21","article-title":"The CIA strikes back: Redefining confidentiality, integrity and availability in security","volume":"10","author":"Samonas","year":"2014","journal-title":"J. Inf. Syst. Secur."},{"key":"ref60","volume-title":"The O-RAN Alliance Security Task Group Tackles Security Challenges on All O-RAN Interfaces and Components","year":"2024"},{"key":"ref61","doi-asserted-by":"publisher","DOI":"10.1109\/mcomstd.0001.2200047"},{"key":"ref62","volume-title":"Information Security, Cybersecurity and Privacy Protection\u2014Guidance on Information Security Risk Management","year":"2022"},{"key":"ref63","volume-title":"Security and trust in open RAN","author":"Kuure","year":"2024"},{"key":"ref64","doi-asserted-by":"publisher","DOI":"10.1109\/blockchain50366.2020.00022"},{"key":"ref65","doi-asserted-by":"publisher","DOI":"10.1016\/j.comnet.2022.109502"},{"key":"ref66","doi-asserted-by":"publisher","DOI":"10.1109\/tmc.2023.3342711"},{"key":"ref67","doi-asserted-by":"publisher","DOI":"10.1109\/lcn60385.2024.10639816"},{"key":"ref68","doi-asserted-by":"publisher","DOI":"10.1109\/tgcn.2024.3432689"},{"key":"ref69","doi-asserted-by":"publisher","DOI":"10.1145\/3465481.3470080"},{"key":"ref70","volume-title":"Post-Quantum Cryptography","year":"2024"},{"key":"ref71","article-title":"Research report on quantum security","year":"2023"},{"key":"ref72","doi-asserted-by":"publisher","DOI":"10.1109\/tvt.2024.3359998"},{"key":"ref73","doi-asserted-by":"publisher","DOI":"10.1007\/s10922-025-09998-x"},{"key":"ref74","doi-asserted-by":"publisher","DOI":"10.1002\/9781119835905"},{"key":"ref75","doi-asserted-by":"publisher","DOI":"10.1016\/j.jnca.2020.102731"},{"key":"ref76","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-98385-1_12"},{"key":"ref77","doi-asserted-by":"publisher","DOI":"10.1186\/s42400-024-00320-x"},{"key":"ref78","article-title":"Publicly available specification (PAS); O-RAN security threat modeling and risk assessment, V3.0.0","year":"2023"},{"key":"ref79","article-title":"Guide to data-centric system threat modeling (draft)","year":"2016"},{"key":"ref80","volume-title":"NTIA Open RAN Security Report","year":"2023"},{"key":"ref81","doi-asserted-by":"publisher","DOI":"10.1109\/jsac.2023.3336190"},{"key":"ref82","doi-asserted-by":"publisher","DOI":"10.1109\/eucnc\/6gsummit58263.2023.10188337"},{"issue":"5","key":"ref83","first-page":"1","article-title":"Integrating zero trust architecture in DevOps pipeline: Enhancing security in continuous delivery environments","volume":"5","author":"Vemula","year":"2022","journal-title":"Trans. Latest Trends IoT"},{"key":"ref84","doi-asserted-by":"publisher","DOI":"10.1109\/mass58611.2023.00015"},{"key":"ref85","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-031-60221-4_41"},{"key":"ref86","doi-asserted-by":"publisher","DOI":"10.1145\/3593021"},{"key":"ref87","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2024.104018"},{"key":"ref88","article-title":"A practical guide to a zero trust implementation","author":"Turner","year":"2021"},{"key":"ref89","doi-asserted-by":"publisher","DOI":"10.1109\/icin56760.2023.10073507"},{"key":"ref90","doi-asserted-by":"publisher","DOI":"10.1109\/ieeestd.2010.5409813"},{"key":"ref91","volume-title":"Zero Trust Maturity Model, Version 2.0","year":"2023"},{"key":"ref92","doi-asserted-by":"publisher","DOI":"10.1109\/jiot.2020.3025775"},{"key":"ref93","volume-title":"Securing the Software Supply Chain: Recommended Practices for Managing Open Source Software and Software Bill of Materials","year":"2023"},{"key":"ref94","volume-title":"Open RAN: The Future of Radio Access Networks","year":"2023"},{"key":"ref95","doi-asserted-by":"publisher","DOI":"10.1016\/j.comnet.2022.109358"},{"key":"ref96","doi-asserted-by":"publisher","DOI":"10.1109\/honet56683.2022.10019186"},{"key":"ref97","doi-asserted-by":"publisher","DOI":"10.7759\/cureus.48920"},{"key":"ref98","doi-asserted-by":"publisher","DOI":"10.3390\/su141811213"},{"key":"ref99","doi-asserted-by":"publisher","DOI":"10.1007\/s10796-021-10199-5"},{"key":"ref100","doi-asserted-by":"publisher","DOI":"10.1109\/issc61953.2024.10603175"},{"key":"ref101","article-title":"A brief survey of open radio access network (O-RAN) security","author":"Chen","year":"2023","journal-title":"arXiv:2311.02311"},{"key":"ref102","doi-asserted-by":"publisher","DOI":"10.1016\/j.comnet.2024.110292"},{"key":"ref103","doi-asserted-by":"publisher","DOI":"10.4018\/978-1-4666-1888-6.ch004"},{"key":"ref104","volume-title":"Study on Zero Trust Architecture for O-RAN","year":"2024"},{"key":"ref105","doi-asserted-by":"publisher","DOI":"10.1109\/ojcoms.2024.3364840"},{"key":"ref106","doi-asserted-by":"publisher","DOI":"10.1109\/icce-taiwan58799.2023.10226959"},{"key":"ref107","doi-asserted-by":"publisher","DOI":"10.1109\/ojcoms.2024.3431681"},{"key":"ref108","doi-asserted-by":"publisher","DOI":"10.1109\/ojcoms.2024.3519725"},{"key":"ref109","doi-asserted-by":"publisher","DOI":"10.1109\/tmc.2022.3188013"},{"key":"ref110","doi-asserted-by":"publisher","DOI":"10.1109\/nfv-sdn59219.2023.10329620"},{"key":"ref111","doi-asserted-by":"publisher","DOI":"10.1109\/FNWF63303.2024.11028866"},{"key":"ref112","doi-asserted-by":"publisher","DOI":"10.1109\/globecom46510.2021.9685775"},{"key":"ref113","doi-asserted-by":"publisher","DOI":"10.1109\/mic.2012.65"},{"key":"ref114","volume-title":"Everything you need to know about open RAN","year":"2024"},{"key":"ref115","volume-title":"Mavenir OpenRAN webinar, 2024","year":"2020"},{"key":"ref116","volume-title":"O-RAN.WG3.TS.E2SM-R004-v07.00 E2 Service Model (E2SM)","year":"2025"},{"key":"ref117","volume-title":"O-RAN.WG3.TS.E2AP-R004-v07.00 E2 Application Protocol (E2AP)","year":"2025"},{"key":"ref118","volume-title":"Common API Framework (CAPIF), V4.0.0","year":"2025"},{"key":"ref119","volume-title":"O-RAN.WG10.TS.O1-Interface.0-R004-v15.00 O-RAN O1 Interface Specification","year":"2025"},{"key":"ref120","volume-title":"O-RAN.WG6.TS.O2-GA&P-R004-v08.01 O2 Interface General Aspects and Principles","year":"2025"},{"key":"ref121","volume-title":"O-RAN.WG3.Y1TD-R004-v02.00 Y1 Interface: Type Definitions","year":"2024"},{"key":"ref122","volume-title":"O-RAN.WG3.Y1AP-R004-v01.01 Y1 Interface: Application Protocol","year":"2024"},{"key":"ref123","volume-title":"O-RAN.WG3.Y1GAP-R004-v01.01 Y1 Interface: General Aspects and Principles","year":"2024"},{"key":"ref124","volume-title":"OPEN RAN risk analysis","year":"2022"},{"key":"ref125","doi-asserted-by":"publisher","DOI":"10.1109\/globecom46510.2021.9685802"},{"key":"ref126","doi-asserted-by":"publisher","DOI":"10.3390\/s24031038"},{"key":"ref127","volume-title":"Anomaly Detection in O-RAN: Jamming","author":"Kryszkiewicz","year":"2023"},{"key":"ref128","volume-title":"6G RAN\u2013Key Building Blocks for New 6G Radio Access Networks","author":"Parkvall","year":"2024"},{"key":"ref129","doi-asserted-by":"publisher","DOI":"10.1016\/j.comnet.2024.110722"},{"key":"ref130","volume-title":"Control, User and Synchronization Plane Specification","year":"2025"},{"key":"ref131","first-page":"1","article-title":"Dynamic trust score explanation and adjustment in zero trust architecture using large language models","volume":"5","author":"Parmar","year":"2025","journal-title":"J. Artif. Intell. Res."},{"key":"ref132","doi-asserted-by":"publisher","DOI":"10.1109\/TMC.2024.3393430"},{"key":"ref133","doi-asserted-by":"publisher","DOI":"10.1109\/trustcom50675.2020.00247"},{"key":"ref134","doi-asserted-by":"publisher","DOI":"10.1051\/e3sconf\/202447203001"},{"key":"ref135","doi-asserted-by":"publisher","DOI":"10.1109\/ieeeconf59524.2023.10476972"},{"key":"ref136","doi-asserted-by":"publisher","DOI":"10.1109\/fnwf63303.2024.11028721"},{"key":"ref137","doi-asserted-by":"publisher","DOI":"10.1109\/wcnc61545.2025.10978671"},{"key":"ref138","article-title":"Security for enterprise telework, remote access, and bring your own device (BYOD) solutions","author":"Scarfone","year":"8545"},{"key":"ref139","volume-title":"Blue\/green deployments on AWS","year":"2025"},{"key":"ref140","doi-asserted-by":"publisher","DOI":"10.1109\/ictc55196.2022.9952437"},{"key":"ref141","volume-title":"Common Attacks Against Car Infotainment Systems","year":"2018"},{"key":"ref142","doi-asserted-by":"publisher","DOI":"10.1109\/globecom52923.2024.10901151"},{"key":"ref143","volume-title":"NOMS2024 keynote\u2013security of O-RAN","author":"Hanna","year":"2024"},{"key":"ref144","volume-title":"The definitive guide to open RAN security","year":"2024"},{"key":"ref145","volume-title":"Open RAN security whitepaper","year":"2022"},{"key":"ref146","doi-asserted-by":"publisher","DOI":"10.1109\/jproc.2025.3526887"},{"key":"ref147","doi-asserted-by":"publisher","DOI":"10.1109\/mcom.001.2400295"},{"key":"ref148","article-title":"Beyond connectivity: An open architecture for AI-RAN convergence in 6G","author":"Polese","year":"2025","journal-title":"arXiv:2507.06911"},{"key":"ref149","doi-asserted-by":"publisher","DOI":"10.1109\/PIMRC62392.2025.11275070"}],"container-title":["IEEE Open Journal of the Communications Society"],"original-title":[],"link":[{"URL":"http:\/\/xplorestaging.ieee.org\/ielx8\/8782661\/10829557\/11299597.pdf?arnumber=11299597","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,12,30]],"date-time":"2025-12-30T06:35:24Z","timestamp":1767076524000},"score":1,"resource":{"primary":{"URL":"https:\/\/ieeexplore.ieee.org\/document\/11299597\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2025]]},"references-count":149,"URL":"https:\/\/doi.org\/10.1109\/ojcoms.2025.3644132","relation":{},"ISSN":["2644-125X"],"issn-type":[{"value":"2644-125X","type":"electronic"}],"subject":[],"published":{"date-parts":[[2025]]}}}