# Task-Driven Manipulation with Reconfigurable Parallel Robots

Daniel Morton1, Mark Cutkosky1, and Marco Pavone2 Support for this work was
provided by NASA under the NIAC program (Grant #80NSSC22K0766). D. Morton is
supported by NSF GRFP.1Daniel Morton and Mark Cutkosky are with the Department
of Mechanical Engineering, Stanford University, Stanford, CA 94305. {dmorton,
<EMAIL_ADDRESS>Pavone is with the Department of Aeronautics and
Astronautics, Stanford University, Stanford, CA 94305<EMAIL_ADDRESS>
###### Abstract

ReachBot, a proposed robotic platform, employs extendable booms as limbs for
mobility in challenging environments, such as martian caves. When attached to
the environment, ReachBot acts as a parallel robot, with reconfiguration
driven by the ability to detach and re-place the booms. This ability enables
manipulation-focused scientific objectives: for instance, through operating
tools, or handling and transporting samples. To achieve these capabilities, we
develop a two-part solution, optimizing for robustness against task
uncertainty and stochastic failure modes. First, we present a mixed-integer
stance planner to determine the positioning of ReachBot’s booms to maximize
the task wrench space about the nominal point(s). Second, we present a convex
tension planner to determine boom tensions for the desired task wrenches,
accounting for the probabilistic nature of microspine grasping. We demonstrate
improvements in key robustness metrics from the field of dexterous
manipulation, and show a large increase in the volume of the manipulation
workspace. Finally, we employ Monte-Carlo simulation to validate the
robustness of these methods, demonstrating good performance across a range of
randomized tasks and environments, and generalization to cable-driven
morphologies. We make our code available at our project webpage,
https://stanfordasl.github.io/reachbot_manipulation/

##  I Introduction

Scientific research missions in space have significantly advanced our
understanding of Earth, the solar system, and the broader cosmos. Recently,
caves and lava tubes on celestial bodies like the Moon and Mars have emerged
as areas of interest due to their distinct geological and astrobiological
characteristics, offering potential insights into the history of the solar
system [1, 2]. Further exploration of these regions may uncover details about
their past habitability, but this exploration is limited by the capabilities
of existing robotic platforms [3], and their inability to access hard-to-reach
locations. While passive observation of the environment is suitable for some
missions, direct interaction and manipulation unlock a broader range of
scientific possibilities, particularly when unconstrained by a small
workspace. For instance, a robot with broad mobility and manipulation
capabilities could extract geological samples from challenging regions, or
assemble preliminary infrastructure for a habitat, in preparation for human
arrival.

Figure 1: ReachBot performs a sample-extraction manipulation task in a cave
environment. By optimally planning (i) where to place the booms and (ii) the
tensions in each boom, we ensure that this task is completed even with
uncertain pose and wrench estimation, and stochastic failure modes.

To address this need, ReachBot is a proposed robotic concept for enhanced
mobility in challenging environments [4, 5, 6, 7, 8]. Using deployable booms
as reconfigurable prismatic joints, ReachBot can extend and traverse across
large regions, accessing hard-to-reach areas of scientific interest (Fig. 1).
However, accessing these areas is only the first step of a larger science
mission with manipulation-based objectives. Building on the sample extraction
example, this task will require (i) aligning a camera to analyze a region
while maintaining a steady view, (ii) applying a force or torque to extract
the sample, through grasping or drilling, and (iii) transporting the sample to
a retrieval location. During this process, ReachBot must also address the
challenges of (i) the stochastic nature of grasping a rock with microspines,
(ii) uncertainty in the required set of wrenches and poses, and (iii)
vibrations and disturbances introduced during execution.

###  I-A Related Work

Figure 2: Concept of operations. (A): Upon approaching an area of scientific
interest, ReachBot’s perception system identifies where the task needs to be
performed, estimates a task wrench, identifies candidate grasp sites in the
area, and estimates the quality of each site. (B): The stance planner
considers the grasp sites and determines the optimal placement of each boom,
for robust task execution. (C): After each boom is attached, the perception
system can identify the quality of each grasp and determine the expected pull-
force distribution for each site. (D): Using this grasp quality information,
the tension planner determines the tensions on each boom to safely achieve the
target task wrench.

For this manipulation application, with multiple booms attached to the
environment, ReachBot is most directly related to cable-driven parallel robots
(CDPRs) and cable-suspended robots (CSRs) [9]. Of these, ReachBot is
comparable to fully-constrained 6D (position and orientation) CDPRs (requiring
at least 7 cables) – as opposed to CDPRs which only control position with
fewer than 7 cables. Representative examples of fully-constrained and under-
constrained CDPRs are [10] and [11], respectively.

Generally, these CDPRs are not reconfigurable, meaning that the positions of
the cable attachment points are fixed. There are a few notable examples of
reconfigurable CDPRs [12], yet often this reconfigurability is either limited
to a single translational axis, or it is a process that is not performed on a
task-by-task basis. SpiderBot [13] is an example of a highly reconfigurable
CSR, and is likely the best direct comparison to ReachBot. However, (i)
SpiderBot is not fully-constrained, having only 4 cables, and (ii) the authors
only study mobility planning rather than using it for manipulation. Others
have considered a task-specific optimization for CDPRs [14] with similar
objectives such as maximizing the tension-closure workspace volume, or
minimizing the cable force. However, this analysis is limited to a 3-DOF
universal joint and does not consider reconfigurability.

Due to ReachBot’s similarities to dexterous manipulation (trading fingers that
push for booms that pull) [8], we can also look at grasp optimization, much of
which builds on the work of [15]. Of particular interest are methods for
planning over a set of discrete candidate grasp points [16] and computing
optimal contact forces [17], which are highly applicable to the planning
methods presented here.

Our past work [6, 8] has also explored a similar motion planning problem:
given a starting and ending position of the ReachBot body and potential grasp
sites, plan a dynamically feasible trajectory and a sequence of stances for
minimizing control effort. However, this motion-focused approach does not
consider the use of ReachBot for specific manipulation tasks, which typically
require a different stance and tensioning than what is produced by the motion
planner.

Statement of Contributions: This paper presents a manipulation planning method
for ReachBot, optimizing for task robustness under uncertain parameters and
stochastic failure modes. We establish a two-part architecture: a stance
planner and a tension planner, each inspired by work in the field of dexterous
grasping. We present an analysis of how these planners improve performance on
relevant tasks, and increase the size of the manipulation workspace. These
methods are compared against a baseline method in a Monte-Carlo-based
simulation. We also present insight into how these methods perform on similar
cable-driven robot architectures. Additional media and code is available at
our project webpage, https://stanfordasl.github.io/reachbot_manipulation/

##  II Planning Framework

Figure 3: Relationship between the ReachBot stance, wrench space, and task
polytope. The X/Y force space, a subset of the wrench space for a 2D ReachBot,
is plotted, along with the task polytope and the task ellipsoid. (A): With no
specified task, this ReachBot stance can resist arbitrary disturbance forces
about the origin of the force space, with magnitudes up to the radius of the
ball. (B): With a specified task ellipsoid or polytope, this stance can
successfully execute the task even with some uncertainty, since the center of
the ellipsoid/polytope is contained in the hull. (C): The task-
ellipsoid/polytope metric can also indicate that a task is feasible, even when
ReachBot is in a stance which is notably not in force closure (i.e. the origin
of the space is not contained in the interior of the hull).

For ReachBot to execute a manipulation task, we consider a multi-stage
scenario (Fig. 2) where ReachBot will first observe the environment, select
the grasp sites to place its booms, and then tension its booms to complete the
task. Here, we define a “task” as a sequence of pose/wrench pairs: a pose in
$SE(3)$, and a wrench in $\mathbb{R}^{6}$ (a combination of a force and
torque). A single-pose task in the context of ReachBot may imply rejecting
disturbances while performing imaging of the environment, and a multi-pose
task may involve a pick-and-place task, such as placing sensors or
instruments.

To account for these stages, and the different information obtained by the
perception system at each stage, we structure the manipulation planner as a
two-part system. The stance planner uses the perception of the environment
(candidate grasp sites and estimated quality of each site) and the task
(estimated positioning of the robot and the required wrench/wrenches) to plan
a ReachBot stance which can complete the task while being robust against
uncertainty and disturbances. Then, the tension planner uses the perception of
the grasps (their expected pull force distribution based on the microspine
gripper model [8]) to safely tension the booms for the desired task without
causing a grasp failure.

###  II-A Assumptions

To guide the experiments, we assume the following:

  1. 1.

ReachBot is located in an environment where it can span the full width of the
space with its booms, such as a lava tube or cave.

  2. 2.

We consider an 8-boom configuration, which has been previously shown to
satisfy capability constraints while minimizing mass and interference [5].

  3. 3.

Manipulation tasks are performed with an end effector on the base of the
robot.

  4. 4.

All booms are primarily loaded in tension but can support a small bending
moment at the shoulder joint. When comparing to CDPRs, we consider cables as
pure-tension members.

  5. 5.

Booms and cables are massless compared to the body.

We also use the following specifications in our experiments: a ReachBot mass
of 10 kg, a maximum gripper pull force of 30N, a maximum boom shoulder moment
of 1 Nm, and an environment subject to Martian gravity ($g=3.71m/s^{2}$).

Note that this method can generalize to a parallel robot with any number of
cables or booms, even if we have fewer than 7 (the minimum number required for
force closure in $\mathbb{R}^{3}$). This method also generalizes to a
manipulation task performed at the end of an arm or boom: to do so simply
requires a transformation of the resultant wrench back to the base of the
robot.

###  II-B Stance planner

####  II-B1 Preliminaries

To select the ReachBot stance that maximizes the probability of a successful
manipulation task, we leverage tools from dexterous manipulation: namely,
wrench spaces, task ellipsoids, and task polytopes [15, 18, 19].

Classically, a grasp wrench space is a subset of $\mathbb{R}^{6}$
corresponding to the set of all possible wrenches (forces and torques) that
can be applied by a set of point contact forces in a dexterous grasp. We
generalize this notion to our setting by considering the set of all possible
wrenches that can be applied by the ReachBot body, given its current stance
and the maximum force that can be applied along each boom. We use the
$L_{\infty}$ definition from [15], with a modification to describe the
unidirectional tensile force from a cable or boom, rather than a cone or
pyramid of possible forces from a point contact with friction (Eq. 1). Here,
$\bigoplus$ denotes the Minkowski sum between the sets of applied wrenches by
each boom (each being a line through wrench space), and $w_{i}$ denotes the
maximum wrench from boom $i$.

$W_{L_{\infty}}=\text{ConvexHull}\left(\bigoplus_{i=1}^{n}\left\\{\mathbf{0},w_{i}\right\\}\right)$
(1)

Within this wrench space, we can define a task ellipsoid: a set of expected
wrenches during the manipulation task, parameterized by an ellipsoid in
$\mathbb{R}^{6}$ [18]. The sizing of this ellipsoid can be selected to best
reflect the task: for instance, in our sample extraction task example (Fig.
1), lifting the sample will require forces distributed primarily along the $z$
direction, and we also anticipate some small disturbance forces and torques
along other directions. The corresponding ellipsoid, therefore, would be
primarily distributed about $z$.

However, the task ellipsoid is difficult to efficiently optimize for. Instead,
we use a task polytope, an $l_{1}$ approximation to the ellipsoid via its
principal axes [19]. We parameterize this task polytope (Eq. 2) by a set of
task basis wrenches $B_{1},\ldots,B_{p}$ (each in $\mathbb{R}^{6}$) and
weights $\sigma_{1},\ldots,\sigma_{p}$. The basis $B$ dictates the principal
components of the task (typically left as an identity), and the weights
$\sigma$ dictate the relative size of the polytope along each basis direction
(typically set to the standard deviations of the task in each wrench
component).

$\mathcal{P}_{task}=\text{ConvexHull}\left(\left\\{\sigma_{1}\cdot
B_{1},\ldots,\sigma_{p}\cdot B_{p}\right\\}\right)$ (2)

Using a task polytope also guarantees that all wrenches within its positive
spanning set are possible with the given ReachBot stance. Therefore, by
selecting an appropriate set of parameters $B$ and $\sigma$, we can guarantee
that the task wrench and any uncertain disturbance wrenches are contained in
the task polytope and thus can be achieved by the ReachBot stance. This
method’s independence from force closure enables it to work even when the task
is in a difficult location (Fig. 3 C), or if there are a limited number of
grasp sites available. This also leads to favorable worst-case outcomes, even
in the event of grasp failure and subsequent closure loss.

####  II-B2 Method

Given a pose and a task ellipsoid defining the distribution of wrenches, we
optimize based on the smallest-magnitude disturbance wrench within the task
polytope which can be resisted by the ReachBot stance (Eq. 3). In general,
this objective seeks to maximize the size of the wrench space about the task
ellipsoid: an “inverse Chebyshev ball” problem, where we modify the polyhedron
to best fit a ball or ellipsoid. Empirically, optimizing via the task polytope
correlates very strongly with the true task ellipsoid.

We also enforce the following constraints:

  * (4)

Unique boom assignment: Each boom can be assigned to at most one grasp site.

  * (5)

Unique site assignment: Each grasp site can be assigned to at most one boom.

  * (6)

Wrench space scaling: The size of the wrench space along each task basis
wrench is non-negative.

  * (7)

Boom non-interference: The directions of the booms are each restricted to lie
in an outward-facing second-order cone, to prevent self-intersection with the
robot body.

  * (8)

Tension limits: Each boom’s tension is positive and limited by the maximum
gripper force, the quality of the grasp site, and the Boolean assignment
variable.

  * (9)

Force-wrench space relationship: This constraint relates the boom forces to
the size of the wrench space about the nominal desired wrench.

The stance planner is a mixed-integer convex program (MICP), and can be
expressed as follows. Here, $A$ is the boolean boom-to-site assignment matrix,
$s$ defines the maximum distance in the wrench space along each basis
direction, $D$ is the precomputed set of possible directions between booms and
sites, $N$ and $\theta$ parameterize the direction and size of the boom
reachability cones, $T$ is the set of boom tensions, $t_{\text{max}}$ is the
maximum boom tension, $q$ is an estimated quality parameter for each site, $w$
is a resultant wrench component, $w_{\text{des}}$ is the desired wrench, and
$B$ is the set of task basis vectors. $\odot$ denotes the Hadamard (element-
wise) product, and ($i$, $j$, $k$) index over all booms, sites, and task basis
vectors, respectively.

maximize $\displaystyle\min(\sigma^{-1}\odot s)$ (3) subject to $\displaystyle
A\mathbf{1}_{n}\leq\mathbf{1}_{m}$ (4) $\displaystyle
A^{T}\mathbf{1}_{m}\leq\mathbf{1}_{n}$ (5) $\displaystyle s\geq\mathbf{0}$ (6)
$\displaystyle D_{ij}\cdot N_{i}A_{ij}\geq\cos(\theta)A_{ij}$
$\displaystyle\forall i,j$ (7) $\displaystyle\mathbf{0}\leq T_{ijk}\leq
t_{\text{max}}q_{j}A_{ij}$ $\displaystyle\forall i,j,k$ (8)
$\displaystyle\sum_{i=1}^{m}\sum_{j=1}^{n}w_{ijk}=w_{\text{des}}+s_{k}B_{k}$
$\displaystyle\forall k$ (9)

####  II-B3 Handling pose uncertainty

The task polytope objective inherently optimizes for robustness against wrench
uncertainty, yet pose uncertainty is also inherent to this planning problem.
For instance, we may estimate a nominal pre-grasp pose for a pick-and-place
task, but after approaching the object, it may be better to slightly adjust
the pose to best grasp it.

When this occurs, the off-nominal pose will shift the directions of each boom,
changing the resultant wrench on the robot’s body. Often, these uncertain
poses can lead to a dramatic shift in the facets of the nominal wrench space,
leading to a potentially much smaller task ellipsoid, or in the worst case,
geometric infeasibility of the task. Note that this sensitivity of the wrench
space to pose uncertainty is dependent on the configuration of the robot and
thus cannot be known prior to evaluating the stance planner.

Unfortunately, expanding the domain of the problem to account for uncertainty
in boom directions leads to computational intractability within reasonable
planning times. Despite this, we propose a simple method of handling pose
uncertainty that integrates easily with our existing wrench-uncertainty-
focused planner.

We rely on the empirical observations that (i) orientation errors are the
primary contributor to geometric infeasibility of a target wrench, and (ii)
stances robust to torque uncertainty are also robust against orientation
uncertainty. Using these observations, we can re-scale the torque component of
the task polytope, increasing the weighting along these dimensions as a
function of orientation uncertainty. Note that when orientation uncertainty is
0, we leave this weighting, $\lambda$ as 1. A simple heuristic that accounts
for this is
$\lambda=1+\lVert{\sigma_{F}}\rVert\lVert{\Delta\Theta}\rVert/\lVert{\sigma_{\tau}}\rVert$,
where $\lVert{\Delta\Theta}\rVert$ is the estimated average magnitude of the
angular error, and $(\lVert{\sigma_{F}}\rVert,\lVert{\sigma_{\tau}}\rVert)$
are the norms of the force and torque components of the nominal task polytope.
As an example, if we expect rotational errors up to 10° in any axis for Task B
in Fig. 4, this scaling factor $\lambda$ equals 4.3, increasing the torque
weighting and bringing the task polytope closer to the ball metric shown in
Task A.

Figure 4: Impact of the task-based stance optimization on the ReachBot wrench
space. Here, we show the optimal ReachBot stances and corresponding wrench
space (decomposed into the spaces of pure forces and torques) for two
different tasks. By changing the task definition from a ball (left) to an
ellipsoid biased towards forces along the z direction (right), the stance
planner adjusts the wrench space to maximize the size of the inscribed task
ellipsoid. This enables ReachBot to be robust against uncertainty in the
wrench or set of wrenches experienced during manipulation.

####  II-B4 Multi-pose extension

If the manipulation task calls for a sequence of wrenches applied at different
poses, we expand the dimensionality of the problem proportionally to the
number of poses. For instance, a pick-and-place task may be defined by
pose/wrench pairs at four key points: pre-grasp, post-grasp, pre-place, and
post-place. Additional pose/wrench pairs can also be added at intermediate
positions for long-horizon trajectories. Given this, we then optimize for the
smallest-magnitude disturbance wrench across all of these pose/wrench pairs in
the trajectory.

###  II-C Tension planner

Once the stance of ReachBot is fixed, we then determine the tensions in each
boom to apply the desired task wrench. For our objective, we employ the
probability of success metric from our previous work [6], based on an
estimated force distribution which is generated through a learned model of the
grasp quality [8].

This convex program (CP) is subject to just two constraints:

  1. 1.

Tension limits: Each boom tension is positive and limited by the maximum
gripper force and the quality of the grasp site

  2. 2.

Task execution: The resultant wrench from all booms equals the desired task
wrench.

This problem can be expressed as follows, where $\Phi$ represents the Gaussian
CDF, $\mu_{i}$, $\sigma_{i}$ represent the estimated pull force normal
distribution parameters for the $i^{th}$ grasp, and $t$ is the boom tension
variable. As with the stance planner, $t_{\text{max}}$ is the maximum boom
tension, $q$ is the site quality parameter, $w_{i}$ is the resultant wrench
from the $i^{th}$ boom, and $w_{\text{des}}$ is desired wrench:

$\begin{array}[]{cl}\text{maximize}&\sum_{i=1}^{n}\log\left[\Phi\left(\frac{\mu_{i}-t_{i}}{\sigma_{i}}\right)\right]\\\
\text{ subject to }&\mathbf{0}\leq t\leq t_{\text{max}}\cdot q\\\
&\sum_{i=1}^{m}w_{i}=w_{\text{des}}\end{array}$

##  III Experiments and Results

###  III-A Naïve baseline

As a point of comparison for the stance planner, we also develop a naïve
baseline method, which extends out the cables (Fig. 5) and guarantees that the
nominal wrench can be achieved. This method retains many of the same
constraints as in the stance planner, but makes no assumptions about
robustness to off-nominal wrenches or poses. Notation follows from the stance
planner.

$\begin{array}[]{cll}\text{maximize}&\sum_{i}\sum_{j}A_{ij}D_{ij}\cdot
N_{ij}&\\\ \text{ subject to }&A\mathbf{1}_{n}\leq\mathbf{1}_{m}&\\\
&A^{T}\mathbf{1}_{m}\leq\mathbf{1}_{n}&\\\ &D_{ij}\cdot
N_{i}A_{ij}\geq\cos(\theta)A_{ij}&\forall i,j\\\ &\mathbf{0}\leq T_{ij}\leq
t_{\text{max}}q_{j}A_{ij}&\forall i,j\\\
&\sum_{i=1}^{m}\sum_{j=1}^{n}w_{ij}=w_{\text{des}}\end{array}$

Figure 5: Comparison of two possible ReachBot stances for a set of possible
sites. Left: a naïve configuration, simply directing the booms outwards from
the body. This configuration has good control over the applied force, but is
very weak in applying torque, since each boom has no effective lever arm on
the body. Right: an optimal configuration, with good control over both applied
force and torque.

###  III-B Computation times

The stance planner, solved with MOSEK via the CVXPY interface, typically finds
the optimal solution within 3 seconds for small problems, and around 30
seconds for large problems (see Table I). Here, problem size is dictated by
the number of feasible sites for each boom – a function of the total number of
sites, and the cone direction constraint. This compute time is reasonable
given ReachBot’s speed.

The tension planner, solved with ECOS via the CVXPY interface, typically
solves in about 1 millisecond. This is always a fixed problem size, and can be
efficiently re-solved online for various applied wrenches.

The naïve planner, also solved with MOSEK, is still a MICP like the stance
planner, but its reduced dimensionality allows for significantly faster
computation times.

All timings are based on a desktop computer with an Intel Xeon E5-2643 CPU at
3.40GHz, with 64 GB RAM.

TABLE I: Average compute times (seconds) |  | Stance planner | Tension planner
---|---|---|---
|  | Optimal | Naïve |
Sites | 10 | 2.24 | 0.204 | 0.0014
20 | 8.10 | 0.244 | 0.0014
30 | 29.3 | 0.292 | 0.0014

###  III-C Evaluation of optimal stance planning on workspace size

Figure 6: Impact of stance optimization on workspace size. Left: manipulation
workspace for cable-driven and boom-driven parallel robots, in a naïve stance.
Right: the manipulation workspace for each robot, but in an optimal stance.
This stance optimization leads to significant increases in the workspace
volume, and reduces the downsides of a lower-degree-of-freedom cable-driven
architecture.

The capability of applying a target wrench is only one part of the
manipulation problem: another key requirement is the workspace size. Our
previous ReachBot works have already highlighted the large workspace size for
ReachBot [4], but this concerns a reachability workspace, rather than a
manipulation workspace. While ReachBot may be able to access a large space
with the existing motion planner, there are no guarantees that it can apply
the wrenches needed for a manipulation task. In general, we need to see that
ReachBot can both access a location (the location is in the Static Equilibrium
Workspace) and apply the desired wrench (the location is in the Wrench Closure
Workspace, for that specific wrench) [20].

Therefore, to evaluate the impact of our planner on the workspace, we compare
the manipulation workspaces between a naïve stance and an optimal stance (See
Fig. 5 for a comparison of these stances). Additionally, we look at how the
workspace varies between a cable-driven and a boom-driven ReachBot, to help
guide the system design as well as demonstrate the applicability of this
method to other reconfigurable parallel robots.

As seen in Fig. 6, in the naïve stance, the cable-driven ReachBot is
significantly hindered by the suboptimal cable placement, primarily due to the
lack of torque authority in this stance. As purely tensile members, cables
must rely solely on the configuration’s geometry to achieve a target wrench,
whereas booms can passively resist small torques through the reaction torques
at their shoulder joints. This can be seen via the torque component of the
robot Jacobian: the geometry of a cable-driven robot may lead to this being
rank-deficient, while the added degrees of freedom from a boom-driven robot
can mitigate this issue. This leads to a relatively large workspace for booms
(Fig. 6), even with a suboptimal stance.

However, if we use the stance planner, this leads to a dramatic improvement in
the workspace volume. Both the boom-driven and cable-driven robots see an
improvement, though this increase is much more significant for the cable-
driven ReachBot. So, while cables are in general less capable than booms,
smart planning of the cable positioning mitigates these downsides and leads to
comparable performance.

###  III-D Validation in probabilistic simulation

Figure 7: Task performance results, evaluated across randomized environments
and tasks in Monte-Carlo simulation. We consider a representative single-pose
task as holding a grasped object steady while rejecting arbitrary
disturbances, and a multi-pose task as picking-and-placing an object between
two locations in the environment. A geometric failure indicates that the task
wrench is infeasible given the current stance, and a stochastic failure
indicates that a commanded tension exceeds a sampled maximum force from a
probabilistic model.

Our optimization objectives for the stance planner and the tension planner are
designed to maximize robustness and safety, but to validate these, we must
evaluate the “true” simulated task robustness of these plans. Specifically, we
want to show that by using these proposed methods, ReachBot can: (i) apply the
required wrench (or set of wrenches) for the manipulation task, even when
these can differ from the original plan, (ii) maintain stability even under
unmodeled vibrational effects or disturbances, and (iii) execute the task in a
manner which leads to a low chance of grasp failure.

To show this, we performed a Monte-Carlo validation of the task robustness in
simulation. For 1000 sampled tasks across 10 randomized environments, we
determine if (1) the task is geometrically feasible given the planned ReachBot
stance, and if so, (2) tension the ReachBot booms and sample from the
stochastic grasp site model to determine if a grasp failure occurred. We
denote a failure at step (1) as a geometric failure, and a stochastic failure
at step (2). Note that stochastic failure is only evaluated if the problem is
geometrically feasible (i.e. the desired wrench or set of wrenches lie within
the wrench space at each pose).

As seen in Fig. 7, while the naïve planner is guaranteed to support the
nominal task, its lack of uncertainty handling leads to poor performance on
off-nominal poses and wrenches. Notably, the main failure mode for the naïve
planner is geometric: i.e., given the ReachBot stance, there is no set of
boom/cable tensions that will achieve the target wrench. The primary reason
for this failure tends to be an inability to produce the required torque for
the task, even if this is small. This is especially an issue with cables,
which cannot passively resist small torques, unlike booms. This passive torque
resistance allows a naïve stance with booms to perform adequately on simple
tasks, though as the task complexity increases, performance degrades
significantly.

Conversely, our optimal stance planner demonstrates high task performance
across both simple and complex tasks, and the stance optimization is
particularly critical for these more complex sequences of wrenches and poses.
We also see that stochastic failure is generally always present, due to the
nature of microspine grasping, but a good configuration can also mitigate the
chance of failure. For example, a naïve stance might evenly distribute tensile
loads across all sites for a nominal wrench, but rejecting a disturbance may
require a very large tensile force applied to a single boom. An optimal stance
under the same disturbance will be able to distribute the added loading across
multiple booms, reducing the chance of failure.

##  IV Conclusion

In this work, we have established a two-part optimization-based planning
method for robust manipulation with ReachBot, leveraging concepts from
dexterous grasping and cable-driven parallel robots. First, the stance planner
selects the placement of ReachBot’s booms through a mixed-integer convex
program, adjusting the wrench space to improve a task-polytope-based
robustness metric. Second, the tension planner determines the forces in each
boom to apply a desired task wrench, solving a fast convex program to minimize
the chance of a grasp failure.

Through our experiments, we’ve shown that these optimizations significantly
increase the size of the manipulation workspace, and lead to robust task
execution even under disturbances or uncertainty in the desired poses or
wrenches required for the task. Given the high reliability of these methods,
this new manipulation capability will motivate new missions and scientific
experiments on the Moon, Mars, and beyond.

Future work in this area includes integrating these optimal manipulation
stances into the ReachBot motion planner, such that the final stance from the
motion plan is the optimal stance for the given manipulation task. Second,
construction on new reconfigurable cable-driven ReachBot hardware is underway,
and experiments on this platform will further demonstrate the need for the
planning methods presented here.

## References

  * [1] R. J. Léveillé and S. Datta, “Lava tubes and basaltic caves as astrobiological targets on earth and mars: A review,” Planetary and Space Science, vol. 58, no. 4, pp. 592–598, 2010.
  * [2] N. J. Fox, “Science 2020-2024: A vision for scientific excellence,” tech. rep., NASA Science Mission Directorate, Sept. 2023.
  * [3] N. Jacobstein, “Nasa’s perseverance: Robot laboratory on mars,” Science Robotics, vol. 6, no. 52, p. eabh3167, 2021.
  * [4] S. Schneider, A. Bylard, T. G. Chen, P. Wang, M. Cutkosky, and M. Pavone, “Reachbot: A small robot for large mobile manipulation tasks,” in 2022 IEEE Aerospace Conference, IEEE, 2022.
  * [5] S. Newdick, T. G. Chen, B. Hockman, E. Schmerling, M. R. Cutkosky, and M. Pavone, “Designing reachbot: System design process with a case study of a martian lava tube mission,” in 2023 IEEE Aerospace Conference, pp. 1–9, 2023.
  * [6] S. Newdick, N. Ongole, T. G. Chen, E. Schmerling, M. R. Cutkosky, and M. Pavone, “Motion planning for a climbing robot with stochastic grasps,” in IEEE ICRA 2023, pp. 11838–11844, 2023.
  * [7] T. G. Chen, B. Miller, C. Winston, S. Schneider, A. Bylard, M. Pavone, and M. R. Cutkosky, “Reachbot: A small robot with exceptional reach for rough terrain,” in IEEE ICRA 2022, pp. 4517–4523, 2022.
  * [8] T. G. Chen, S. Newdick, J. Di, C. Bosio, N. Ongole, M. Lapôtre, M. Pavone, and M. Cutkosky, “Locomotion as manipulation: Grasp analysis for ReachBot,” Science Robotics, 2024.  Submitted.
  * [9] S. Qian, B. Zi, W.-W. Shang, and Q.-S. Xu, “A review on cable-driven parallel robots,” Chinese Journal of Mechanical Engineering, vol. 31, p. 66, Aug 2018.
  * [10] A. Pott, H. Mutherich, W. Kraus, V. Schmidt, P. Miermeister, and A. Verl, IPAnema: A family of Cable-Driven Parallel Robots for Industrial Applications, pp. 119–134.  Berlin, Heidelberg: Springer Berlin Heidelberg, 2013.
  * [11] L. Cone, “Skycam: An aerial robotic camera system,” Byte, vol. 10, no. 10, pp. 122–132, 1985.
  * [12] D. Q. Nguyen, On the Study of Large-Dimension Reconfigurable Cable-Driven Parallel Robots.  Theses, Université Montpellier 2, Dec. 2014.
  * [13] A. Capua, A. Shapiro, and S. Shoval, “Spiderbot: a cable-suspended walking robot,” Mechanism and Machine Theory, vol. 82, pp. 56–70, 2014.
  * [14] D. Lau, K. Bhalerao, D. Oetomo, and S. K. Halgamuge, “On the task specific evaluation and optimisation of cable-driven manipulators,” in Advances in Reconfigurable Mechanisms and Robots I (J. S. Dai, M. Zoppi, and X. Kong, eds.), (London), pp. 707–716, Springer London, 2012.
  * [15] C. Ferrari and J. Canny, “Planning optimal grasps,” in IEEE ICRA 1992, pp. 2290–2295 vol.3, 1992.
  * [16] A. Cauligi, P. Culbertson, B. Stellato, D. Bertsimas, M. Schwager, and M. Pavone, “Learning mixed-integer convex optimization strategies for robot planning and control,” in IEEE CDC 2020, pp. 1698–1705, 2020.
  * [17] S. P. Boyd and B. Wegbreit, “Fast computation of optimal contact forces,” IEEE T-RO, vol. 23, no. 6, pp. 1117–1132, 2007.
  * [18] Z. Li and S. Sastry, “Task-oriented optimal grasping by multifingered robot hands,” IEEE Journal on Robotics and Automation, vol. 4, no. 1, pp. 32–44, 1988.
  * [19] R. Haschke, J. Steil, I. Steuwer, and H. Ritter, “Task-oriented quality measures for dextrous grasping,” in IEEE CIRA 2005, pp. 689–694, 2005.
  * [20] M. Gouttefarde, J.-P. Merlet, and D. Daney, “Determination of the wrench-closure workspace of 6-dof parallel cable-driven mechanisms,” in Advances in Robot Kinematics, (Dordrecht), pp. 315–322, Springer Netherlands, 2006.


# End-to-End O-RAN Security Architecture, Threat Surface, Coverage, and the
Case of the Open Fronthaul

Aly Sabri Abdalla and Vuk Marojevic
Dept. Electrical and Computer Engineering, Mississippi State University,
Mississippi State, MS, USA
<EMAIL_ADDRESS><EMAIL_ADDRESS>
###### Abstract

O-RAN establishes an advanced radio access network (RAN) architecture that
supports inter-operable, multi-vendor, and artificial intelligence (AI)
controlled wireless access networks. The unique components, interfaces, and
technologies of O-RAN differentiate it from the 3GPP RAN. Because O-RAN
supports 3GPP protocols, currently 4G and 5G, while offering additional
network interfaces and controllers, it has a larger attack surface. The O-RAN
security requirements, vulnerabilities, threats, and countermeasures must be
carefully assessed for it to become a platform for 5G Advanced and future 6G
wireless. This article presents the ongoing standardization activities of the
O-RAN Alliance for modeling the potential threats to the network and to the
open fronthaul interface, in particular. We identify end-to-end security
threats and discuss those on the open fronthaul in more detail. We then
provide recommendations for countermeasures to tackle the identified security
risks and encourage industry to establish standards and best practices for
safe and secure implementations of the open fronthaul interface.

###### Index Terms:

3GPP, open fronthaul, O-RAN, security, standardization.

##  I Introduction

Recent advances in wireless communications are expected to enable a fully
mobile and connected society in the future, which will be characterized by the
tremendous growth in connectivity, traffic volume, and a much broader range of
services. Besides the market requirements, the mobile communication society
also requires a sustainable development of the ecosystem which produces the
need for further improved system efficiencies, including spectrum efficiency,
energy efficiency, operational efficiency, and cost efficiency.

As the preparation of the fourth release of 5G—5G Advanced—is underway, the
companies and partner organizations identify various technical topics that
need to be researched in Release 18 and future releases. Unlike Releases 16
and 17, which helped extend 5G to new verticals, the objective of Release 18
is covering more demanding applications, such as truly mobile extended reality
services, network intelligence, and enhanced support for new use cases.
Therefore, new technologies and paradigm shifts are expected for supporting
the critical aspects of next-generation wireless communication networks as
part of 5G Advanced and 6G standardization efforts.

The current 5G architecture has been designed on the basis of network
virtualization, Cloud technology, and software-defined networks (SDNs) to
enable agile and self-adapting network solutions. 5G considers edge computing
and other critical architectural refinements over previous network generations
[1]; however, the deployment follows the trend of previous generations and may
lead to 5G becoming a by and large monolithic and inflexible infrastructure
with vendor lock-in. Next-generation network innovation requires the
transformation to a flexible, agile and disaggregated architecture to support
service heterogeneity, coordination among multiple technologies, and rapid on-
demand deployments. Such transformations are enabled by the emerging open
radio access network (O-RAN).

O-RAN is an industry-driven architecture that is maintained by the O-RAN
Alliance. Openness and intelligence are among the main characteristics of the
O-RAN architecture that enables multi-vendor, inter-operable, artificial
intelligence (AI) empowered hierarchical networks [2]. Network disaggregation
is one of the O-RAN architectural features that has been elevated by
decoupling network functions and harnessing SDN/NFV principles [3]. The unique
components, interfaces, and technologies of O-RAN differentiate it from those
of 3GPP, while leveraging the 3GPP framework and protocols. The security
challenges and resultant risks of O-RAN will therefore be different from those
of legacy 3GPP networks and must be carefully studied to reduce risks,
vulnerabilities, and exposures to attacks and misconfigurations.

The O-RAN Alliance defines study items that are currently organized into
eleven technical workgroups (WGs) and four focus groups (FGs). One of the WGs
is the security WG (SWG) which is committed to developing the security
requirements, designs, and solutions that enable an open, interoperable, and
secure O-RAN system. The SWG established itself in the second quarter of 2021
and has since developed initial work items specifying initial O-RAN security
threat models and security protocols to be addressed when building a secure
end-to-end O-RAN system [4, 5]. Academics have started to evaluate the
security of O-RAN. The work presented in [6] has demonstrated a security
evaluation of the O-RAN architecture with a threat analysis for different
domains. Reference [7] shows a security vulnerability case study revealing the
missing authentication and authorization of O-RAN interfaces and components.

This paper compiles the threat vectors against the major O-RAN components: the
open fronthaul, the near and non-real time RAN intelligent controllers (RICs),
the service management and orchestration (SMO), the O-RAN Cloud, and the
machine learning (ML)/AI employed by xApps and rApps. We then focus our
detailed threat analysis on O-RAN’s open fronthaul interface and services, and
introduce the security countermeasures to tackle the identified security
risks. Our initial research provides recommendations and guidelines for
consideration and further evaluation, leading to standards and best practices
for safe and secure O-RAN implementation and operation.

The rest of the paper is organized as follows: Section II presents the O-RAN
architecture, including its components and interfaces, with focus on security
threats and principles. Section III discusses the O-RAN open fronthaul
threats. Section IV introduces the security countermeasures to preserve the
security requirements of the open fronthaul given the previously identified
threats. Section V provides the concluding remarks.

##  II End-to-End O-RAN Security Architecture, Threats, and Security Coverage

Figure 1: The O-RAN architecture with security requirements.

This section introduces the O-RAN security requirements. Fig. 1 presents the
O-RAN architecture and identifies the general security needs. The O-RAN
architecture is divided into two main subsystems. These are the RAN and the
SMO. The logical components of the RAN subsystem include the O-RAN central
unit (O-CU), the O-RAN distributed unit (O-DU), and the O-RAN radio unit
(O-RU). In addition, there are two RAN Intelligent Controllers (RICs) that
cover different timescales: the near-real time RIC (near-RT RIC), which is
part of the RAN subsystem, and the non-RT RIC, which is part of the SMO. O-RAN
micro-services called xApps and rApps implement near-RT and non-RT control
services as part of the near-RT and non-RT RICs, respectively [8].

O-RAN defines open interfaces to handle the data and control flows between the
O-RAN components, which may be implemented as virtual machines and execute on
a single compute nodes or on networked nodes. The open fronthaul establishes
the interface between the O-RU and the O-DU [9]. The F1 interface connects the
O-CU to the O-DUs. The E1 interface enable coordination between the O-CU
control and user planes. The E2 interface forwards the measurements from the
O-DU and O-CU to the near-RT RIC and the configuration commands to the O-CU
and O-DU. User or RAN-specific data can be fed to the xApps for data
processing employing AI. The O1 interface is accountable for collecting the
data from all of the connections for operations & administration functions.
Policy guidance can be transmitted via the A1 interface to xApps implementing
AI models that may support RAN applications such as network slicing, quality
of service (QoS) and resource management, and mobility management [10].

End-to-end security is a mandatory feature and must be maintained and managed
across all components and interfaces of the O-RAN architecture. However, the
openness, disaggregation of network functionalities, and intelligence are the
unique properties of O-RAN and facilitate the integration of new functions,
protocols, components, and interfaces. This openness expands the threat
surface and makes O-RAN prone to additional security risks beyond those of the
3GPP architecture. Table I presents the major O-RAN security risks and threats
that have been identified by the SWG [4, 5]. Table I also identifies the
affected components and the main security principles that should be taken into
consideration while defining security requirements, recommendations, and
countermeasures in future standardization efforts.

With the expanded threat surface of O-RAN, different security features across
the O-RAN architecture need to be identified to protect the critical assets
and maintain the integrity, availability, confidentiality, replay protection,
and authenticity. In continuation, we introduce the security features as
defined for the main O-RAN components [4, 5].

TABLE I: O-RAN threats and coverage security principles [4, 5]. O-RAN Component |  Threat |  Affected Components |  Security Principles
---|---|---|---
Front-haul |  Fronthaul |  \- An attacker penetrates O-DU and beyond through O-RU
\- Unauthorized access to the open fronthaul Ethernet L1 physical layer interface |  rApps, xApps, O-RU, O-DU, O-CU, Near-RT RIC, Non-RT RIC |  Mutual authentication, access control, cryptography, key management, public key infrastructure (PKI), trusted communication, and security assurance
|  M-Plane |  \- An attacker attempts to intercept the fronthaul (man in the middle—MITM—attack) over the M-Plane |  rApps, xApps, O-RU, O-DU, O-CU, Near-RT RIC, Non-RT RIC |
|  S-Plane |  \- Denial of service (DoS) attack against a master clock
\- Impersonation of a master clock (spoofing) within a precision time protocol
(PTP) network with a fake ANNOUNCE message
\- Rogue PTP instance claiming the role of a grand master clock
\- Selective interception and removal of PTP timing packets
\- Packet delay manipulation attack |  O-DU, O-RU |
|  C-Plane |  \- Spoofing of downlink (DL) C-plane messages \- Spoofing of uplink (UL) C-plane messages |  O-DU, O-RU |
|  U-Plane |  \- An attacker attempts to intercept the fronthaul (MITM) over U-plane |  O-DU, O-RU |
Near-RT RIC |  Near-RT RIC |  \- Malicious apps can exploit UE identification, track UE location and change UE priority |  Near-RT RIC, UE, xApps |  Secure boot and self-configuration, security management of open source software, privacy assurance, continuous logging, monitoring and vulnerability handling, robust isolation, secure Cloud computing and virtualization
|  xApp |  \- An attacker exploits xApps vulnerabilities and misconfiguration
\- Conflicting xApps unintentionally or maliciously impact O-RAN system
functions to degrade performance or trigger DoS
\- An attacker compromises xApp isolation |  O-CU, Near-RT RIC, xApps |  Mutual authentication, access control, cryptography, key management, PKI, robust isolation, secure Cloud computing and virtualization, recoverability & backup
Non-RT RIC |  Non-RT RIC |  \- An attacker penetrates the non-RT RIC to cause DoS or degrade the performance
\- UE sniffing in the Non-RT RIC |  Non-RT RIC, rApps, UE |  Mutual authentication, access control, cryptography, key management, PKI, privacy assurance, security management of open source software, secure Cloud computing and virtualization, secure boot and self-configuration
|  rApp |  \- An attacker exploits rApps vulnerabilities and misconfiguration
\- An attacker bypasses authentication and authorization
\- An attacker compromises rApp isolation
\- Conflicting rApps unintentionally or maliciously impact O-RAN system functions to degrade performance or trigger DoS |  rApps, UE, Non-RT RIC, Near-RT RIC, xApps |  Mutual authentication, access control, cryptography, key management, PKI, privacy assurance, secure boot and self-configuration, robust isolation, secure Cloud computing and virtualization, continuous logging, monitoring and vulnerability handling.
SMO |  \- An attacker can exploit the improper/missing authentication of SMO functions
\- Overload DoS attack |  SMO components |  Mutual authentication, access control, privacy assurance, recoverability & backup, privacy assurance, continuous logging, monitoring and vulnerability handling, secure update
O-Cloud |  \- An attacker compromises VNF/CNF images and embedded secrets
\- An attacker exploits weak orchestrator configuration, access control and
isolation
\- Misuse of a virtual machine (VM) or container (CN) to attack other VM/CN,
hypervisor/container engine, other hosts (memory, network, storage), etc.
\- Spoofing of and eavesdropping on network traffic
\- An attacker compromises auxiliary/supporting network and security services |  O-Cloud components |  Mutual authentication, access control, privacy assurance, recoverability & backup, privacy assurance, continuous logging, monitoring and vulnerability handling, secure update, secure boot and self-configuration, robust isolation, secure storage
ML/AI |  \- Poisoning the ML training data (data poisoning attack)
\- An attacker exploits weak orchestrator configuration, access control and
isolation
\- ML model alteration (system manipulation and compromise ML data
confidentiality and privacy)
\- Spoofing of and eavesdropping on network traffic
\- Transfer learning attack |  Near-RT RIC, Non-RT RIC, xApps, rApps |  Mutual authentication, access control, continuous logging, monitoring and vulnerability handling, recoverability & backup, privacy assurance, secure boot and self-configuration, secure update, secure Cloud computing and virtualization

  * •

Fronthaul interface domain security: A set of features and mechanisms that
enable a secure flow of critical control, user, management, and
synchronization plane data, such as timing configuration, troubleshooting and
trace logs, and user data, that are transported over the fronthaul,
interconnecting multiple O-RUs and O-DUs.

  * •

Near-RT RIC domain security: A set of features and mechanisms that safeguard
data transported toward the near-RT RIC which then optimizes the overall RAN
performance over the following interfaces: 1 the policies applicable to UEs
and cells and A1 enrichment information delivered over the A1 interface and 2
the persistent configuration used by the near-RT RIC to control the RAN, xApp-
related messages, near-RT RIC services messages and policies used to monitor,
suspend/stop, override or control the behavior of the E2 node delivered over
the O1 and E2 interfaces.

  * •

Non-RT RIC domain security: A set of features and mechanisms that ensure 1
secure creation, modification, and management of A1 policies and A1 enrichment
information that is collected or derived at the SMO/non-RT RIC and 2
authentication and authorization of the discovery and request of A1 enrichment
information from the near-RT RIC.

  * •

xApp and rApp domain security: A set of features and mechanisms for protecting
1 the training or test data, 2 the trained ML model, and 3 the expected
prediction outcomes. The data sets may be collected externally or internally
to the near-RT RIC, O-CU, O-DU, and O-RU and passed to the ML training hosts
to be applied by an xApp or rApp. The trained ML model may include
intellectual property information, numerous hyperparameters and millions of
learned parameters. The expected prediction outcomes of the ML model and the
behavior of the ML system include tasks for data collection, data wrangling,
pipeline management, model retraining, and model deployment.

  * •

O-RU domain security: A set of features and mechanisms that facilitate the
secure exchange of reference signals, synchronization signals, and data and
control channels in the downlink and uplink between the O-RUs and UEs.

  * •

O-CU and O-DU domain security: A set of features and mechanisms that maintain
the integrity of the 3GPP application-related data such as subscription data,
session data, call control and inter and intra-slice UE priority related
information.

  * •

O-Cloud domain security: A set of features and mechanisms that need to be
provisioned to minimize risk exposure affecting telemetry information of
O-Cloud deployments, O-Cloud provisioning information, and O-Cloud software
management information.

##  III Open Fronthaul Security Threats

In this section we examine the potential threats targeting the open fronthaul
interface and the management, control, user, and synchronization data planes
transmitted over the open fronthual interface within the O-RAN architecture
and provide a risk analysis associated with each threat.

###  III-A Threats against the fronthaul interface

The first threat category is related to attack exploit vulnerabilities of the
open fronthaul interface.

Figure 2: The O-RAN fronthaul.

Functional splits were introduced in 3GPP Release 15 to allow splitting the
base station functionalities into the CU and the DU, implementing the higher
and lower layers of the RAN protocol stack, respectively. Although 3GPP
defines many split options, vendors use proprietary implementations and
interfaces which has led to single vendor network solutions. O-RAN adopts
functional split Option 2 for the F1 interface between the O-DU and O-CU, and
Option 7.2x for implementing the fronthaul, the interface between the O-DU and
O-RU as shown in Fig. 2.

O-RAN employs a modified version of the common public radio interface (CPRI),
the enhanced CPRI (eCPRI), for the fronthaul [11]. The eCPRI interface allows
for the separation of the radio unit and the baseband unit, and enables the
use of off-the-shelf networking equipment, which can reduce the costs and
increase the scalability of the network.  This facilitates having different
vendors for the O-RUs and the O-DUs, which need to be managed as different
entities that may have heterogeneous security levels. The O-DU will have to
bridge the control and other data traffic between the management O-CU and the
O-RU as shown in Fig. 1. Hence the possibilities to reach and penetrate the
northbound systems (O-CU, near-RT RIC, and SMO) beyond the O-DU through the
open fronthaul interface becomes a possible vulnerability in this split
architecture that can be exploited by an attacker.

Another threat is the unauthorized access to the physical layer, or layer 1
(L1), of the open fronthaul by comprising one or more coaxial cables, twisted
pairs, RF links, or optical fibers. Each end of the physical interface
encompasses a physical connection (an Ethernet port) to physical O-RAN network
elements, the O-DU and the O-RU. An attacker who gains physical access to the
fronthaul interface can launch attacks that can compromise the availability,
integrity, and confidentiality of the interface. Specifically, an unauthorized
device on the fronthaul interface can

  1. 1.

Flood the L1 interface with network traffic causing disruption or degradation
of authorized network elements on the fronthaul interface,

  2. 2.

Transmit L2 packets to authorized network devices causing disruption or
degradation of the fronthaul interface performance,

  3. 3.

Deny services by disabling a physical connection to a network element either
by removing an Ethernet port connection or cutting the physical interface, and

  4. 4.

Access and manipulate the management, synchronization, control, and user plane
traffic.

###  III-B Threats against the management, synchronization, control, and user
planes

According to the O-RAN fronthaul specifications, there are four types of
planes that support the various functionalities of the O-RAN fronthaul:
management plane (M-plane), synchronization plane (S-plane), user plane
(U-plane), and control plane (C-plane).

I

The M-plane provides a variety of management functions to set O-RU parameters
as required by the C/U-plane and S-plane, manage the O-RU software, perform
fault management, and so forth. The O-RAN fronthaul specifications for the
M-plane provide various parameters for fault, configuration, accounting,
performance, and security (FCAPS) functions. The 7.2x functional split
requires high bit rate transmissions with strict bandwidth, latency, and
transport link performance requirements. This limits the options for employing
extensive security measures within the O-RAN system because of the the
processing delay that they would incur. As a result, the O-RAN security risks
increase, specifically for the M-plane, where an attacker may be capable of
launching man-in-the-middle (MITM), passive wiretapping, or denial of service
(DoS) attacks over the fronthaul interface to intercept the M-plane messaging
after gaining unauthorized access to the operations and maintenance (OAM).

II

The S-plane is responsible for the timing and synchronization of messages
between the O-DU and O-RU. Through the S-plane, the O-RAN fronthaul
specifications support protocols such as precision time protocol (PTP) and
synchronous Ethernet (SyncE) to achieve high-accuracy synchronization between
the O-RU and the O-DU, which supplies the the master clock. The S-plane must
be protected against DoS attacks targeting the master clock of the timing
network used by the fronthaul to maintain availability and accuracy of the
O-RAN system. An attacker can attack the master clock by sending an excessive
number of time protocol packets. Such an attack may result in a situation
where the clock service is interrupted or the timing protocol is operational
but slaves are being provided inaccurate timing information due to the
degraded performance of the master clock. An attacker within the PTP network
may also impersonate the grand-master (GM) clock’s identity and announce
itself as a GM candidate by either modifying the in-flight protocol packets or
by injecting fake ANNOUNCE messages.

A GM impersonation attack can result in the PTP remaining operational and all
clocks synchronized, but inaccurate timing information being intentionally
distributed. The attacker may be residing either within the attacked network
as an insider or on an external network connected to the network under attack.
An attacker can also position itself in such way to allow intercepting and
removing valid synchronization packets. This could lead to clock
synchronization errors of all clocks downstream or trigger the free-running
mode. Attacks may be launched close to the GM by tapping the egress traffic of
an active GM clock to effect a larger set of slaves who depend on this GM for
time synchronization. Attacks may also target one or more slaves by tapping
the ingress traffic of a particular slave. Alternatively, an MITM attack may
be launched from an intermediate node such as a transparent clock (TC),
router, or switch. This implies that the attacker has obtained physical access
to a node in the PTP network or has gained full control of one device in the
network. Selective interception and removal can impact timing packets and
cause clock degradation of the attacked nodes. Removing all packets or random
packets may trigger the free running mode [4, 5].

Another threat on the S-plane is the packet delay manipulation that may
disrupt the symmetric delays between the GM clock and the slaves. An attacker
would launch this attack by either tapping the transmission network or by
taking control of intermediate nodes such as routers, switches, or TCs and
provide intentionally inaccurate timing information to slaves. Clock service
disruption or time accuracy degradation would occur and may cause DoS to
applications that rely on accurate time or potentially bringing down an entire
cell. A cell outage caused by misaligned timing may further impact performance
of neighboring cells.

III

The U-plane is responsible for the efficient user data transfer of in-phase
and quadrature (IQ) samples within the strict time limits of the 5G
numerology. For the transported U-plane data, an attacker may launch
eavesdropping and DoS attacks after breaking the packet data convergence
protocol (PDCP) security prior to any content access. 3GPP defines U-plane
integrity protection algorithms in their specifications, but many of the OEMs
may not implement them because they are resource demanding and may impact the
user experience, specifically the download and upload data rates. Enabling
U-plane integrity protection requires considerable computing resources and
adds overhead that directly impacts the maximum throughput that can be
measured on the user device. The integrity protection is enabled on the
C-plane messages but that still leaves the user’s data traffic vulnerable
because the C-plane and U-plane are segregated. For example, the lack of
uplink integrity could enable a rogue base station to manipulate the user data
messages and redirect a user to a malicious website.

IV

C-plane messages pass from the O-DU to O-RUs and carry information about the
scheduling, the coordination required for data transfer, beamforming, mixed
numerology, and PRACH handling parameters to be employed when transmitting and
receiving IQ sample sequences included in the U-plane message.

A downlink C-plane message covering multiple symbols must arrive at the O-RU
before the end of the downlink U-plane receive window. The lack of
authentication could allow an adversary to inject fake downlink C-plane
messages that falsely claim to be from the associated O-DU. This could result
in blocking the O-RU from processing the corresponding U-plane packets,
leading to temporary DoS.

A uplink C-plane message includes multiple symbols that must be delivered to
the O-RU prior to the reception of the earliest air interface uplink U-plane
signal sample. Uplink C-plane messages from the O-RU to the O-DU are only
defined for LTE licensed assisted access (3GPP TR 36.889) and New Radio-
Unlicensed (3GPP TR 38.889) operations; otherwise, there should be no C-plane
messages originating at the O-RU. The lack of authentication may result in an
adversary injecting fake uplink C-plane messages into O-RUs. This may lead to
reduced cell performance or even DoS encompassing all O-RUs that are
associated with the mimicked O-DU.

##  IV Fronthaul Security Coverage

Figure 3: Secured O-RAN fronthaul interface.

This section discusses the possible set of security features and mechanisms
that are of critical importance to be implemented within the O-RAN system for
tackling potential threats to the fronthaul interface and the corresponding
management, control, user, and synchronization data planes. The provided
security solutions in this section are expected to initiate further analysis
and refinement for devising security requirements, recommendations, and
potential countermeasures as part of future O-RAN architectural revisions. In
what follows, we identify different mutual authentication solutions that need
to be established for the O-RAN system of Fig. 3 to be able to verify who does
what as a means to detect fake base stations, unauthorized or malicious
components, applications, users and administrators. Mutual authentication that
is capable of filtering unauthorized/unexpected traffic flowing through O-RAN
components and interfaces, can restrict access to component configurations and
provide legitimate access to the hardware and software to maintain the trust
chain. In continuation we elaborate on certificate-based authentication, port-
based authentication, and IP security-based authentication.

Figure 4: Mutual authentication between the O-RAN PTP client and the O-RAN
authentication server via X.509 certificates  Figure 5: The IEEE 802.1x
authentication procedures for secure MAC connectivity (b).

  * •

Certificate-Based Authentication: In order to authenticate each network
component, a unique identifier and one or more credentials that need to be
securely stored are needed. A candidate approach is the mutual O-RAN component
authentication based on client/ server certificates, such as X.509
certificates [12]. The X.509 is a public key infrastructure (PKI) standard
that is based on a strict hierarchical organization of the certificate
authorities (CAs) in which the trust can only flow downwards. The CA acts as
an effortlessly reachable trust anchor to all the components and interfaces
within the O-RAN security architecture so that they can acquire the
certificates during the secure socket layer/ transport layer security (SSL/
TLS) handshake. After a X.509 certificate is issued and signed by a trusted
CA, the user can be confident that the certificate owner or host name/ domain
has been validated. An additional benefit of this certificate-based
authentication approach is scalability. The PKI architecture is scalable in
that it can secure huge amounts of exchanged messages by different components
and interfaces within the O-RAN network and across the Internet. What enables
this is that public keys can be distributed widely and openly without
malicious actors being able to discover the private key required to decrypt
the message.

The X.509 certificate fields contain information about the identity that the
certificate is issued to as well as the identity of the issuing CA. The
standard fields include: version, serial number, algorithm information, issuer
distinguished name, validity period of the certificate, subject distinguished
name, and subject public key information. The O-RAN security specifications
need to specify which identity fields in the X.509 certificate should be
checked during authentication, how these fields are formatted, and what the
fields should be checked against to enable mutual authentication in an
interoperable manner. The authenticated information is then used for
authorization and policy control. O-RAN should make the profiling of the non-
cryptographic identity fields in the X.509 certificate stricter to enable
interoperability among vendors. Fig. 4 presents an example of using mutual
authentication based on X.509 certificates to authenticate the session between
the PTP client and the authentication server in the O-RAN system.

  * •

Port-Based Authentication: The openness, multi-vendor support, and the 7.2x
split require that various clients access the northbound components and
interfaces of O-RAN. Therefore, it is mandatory to enable harmonious
authentication, authorization, and cryptographic key agreement mechanisms to
support secure communication and network access in a point-to-point local area
network (LAN) for the different client segments across the open fronthaul. The
IEEE 802.1x port-based access control mechanism is a candidate authentication
scheme that can be implemented to rectify access by handling the transmission
and reception of unidentified or unauthorized entities over the O-RAN
fronthaul interface at the MAC layer and thus avoid consequent network
disruption, such as service or data loss.

IEEE 802.1x is a framework on top of which different authentication
techniques, such as certificate-based one-time passwords and smartcard readers
[13] can be employed. It implements the extensible authentication protocol
(EAP) for transporting the authentication information and the verification of
various authentication mechanisms through challenge-response. One of the main
benefits of IEEE 802.1x is that most of the processing happens on the side of
the clients that need access. The main components of IEEE 802.1x are the
supplicant, authentication server, and authenticator. The supplicant is the
new user or client who wants to be authenticated, the authentication server is
the server that validates the credentials transferred by the supplicant for
determining its access, typically a RADIUS server, and the authenticator is
the intermediate node that controls the communication between the supplicant
and authentication server. Fig. 5 shows the corresponding message exchanges
between the supplicant, O-RAN fronthaul authenticator, and the O-RAN
authentication server for establishing secure MAC connectivity.

Figure 6: Packet Tracer IPsec simulation scenario Figure 7: The number of
decrypted packets at the open fronthaul network termination for authenticated
and malicious O-RU traffic over time.

  * •

IP Security-Based Authentication: O-RAN facilitates having different
components, such as the O-RU and O-DU, supplied and managed by independent
vendors that may implement different security mechanisms. Such heterogeneous
security measures can introduce system vulnerabilities. However, it is not
practical to maintain such a network within O-RAN taking into consideration
the challenges of managing the complex infrastructure across multiple vendors
over geographically dispersed areas. Alternatively, Internet Protocol security
(IPsec) can be implemented over the fronthaul interface of O-RAN at the IP
layer for securing host-to-host IP packets and all other higher-layer
protocols. IPsec is used for securing non-3GPP access to the 5G core network
[14]. IPsec is designed based on an authentication header (AH), encapsulating
security payload (ESP), and Internet key exchange (IKE) transport-level
protocols to provide authentication for the source and content of IP packets
and, optionally, cipher the payload data. These three protocols empower IPsec
to provide authentication; specifically, proof of data source, data integrity,
and replay protection.

In order to validate the benefits of IPsec, we have set up an O-RAN emulation
platform. Fig. 6 shows the network topology that we consider. We assume that
there are two O-RUs coming from different vendors, Vendor X and Vendor Z,
where the O-RU from Vendor X is authenticated and the O-RU from Vendor Z is
not in the authenticated O-RU list. Both the authenticated O-RU and the non-
authenticated and potentially malicious O-RU aim to connect to the O-CU via an
O-DU through the open fronthaul. We implement the IPsec tunnel that allows
traffic coming from authenticated sources while blocking any traffic coming
from unauthenticated entities. Without loss of generality, we assume time
division multiple access for multiplexing the two O-RU transmissions. Each
transmission phase is a simulation time unit that is characterized by four
packet transmissions. Fig. 7 plots the decrypted packets by the O-RAN
fronthaul termination at the O-DU over time. It shows that the implemented
IPsec mechanism at the open fronthaul blocks packets coming from the non-
authenticated/ malicious O-RU and lets packets through from the authenticated
radio.

##  V Conclusions

The new RAN technologies and paradigm shift toward open, disaggregated,
interoperable, multi-vendor, and AI empowered hierarchical networks expand the
attack surface, introducing new security challenges and resultant risks. This
article surveys the security vulnerabilities and threats targeting the O-RAN
components with a focused study on the open fronthaul interface and the
associated management, synchronization, control and data planes. Based on the
identified threats, we discuss countermeasures to improve the security related
to the open fronthaul in a multi vendor O-RU/O-DU context. This paper is
expected to spur research and encourage industry to establish guidelines,
standards, and best practices for safe and secure implementations of O-RAN’s
open fronthaul interface.

## Acknowledgement

This work was supported in part by the National Science Foundation under grant
number 2120442.

## References

  * [1] S. Niknam _et al._ , “Intelligent O-RAN for beyond 5G and 6G wireless networks,” _arXiv preprint arXiv:2005.08374_ , 2020.
  * [2] P. S. Upadhyaya, A. S. Abdalla, V. Marojevic, J. H. Reed, and V. K. Shah, “Prototyping Next-Generation O-RAN Research Testbeds with SDRs,” 2022.
  * [3] A. S. Abdalla, A. Yingst, K. Powell, A. Gelonch-Bosch, and V. Marojevic, “Open source software radio platform for research on cellular networked UAVs: It works!” _IEEE Communications Magazine_ , vol. 60, no. 2, pp. 60–66, 2022\.
  * [4] O-RAN, “O-RAN Security Threat Modeling and Remediation Analysis,” O-RAN Alliance, Technical Report Version 02.01, March 2022.
  * [5] O-RAN, “O-RAN Security Requirements Specifications,” O-RAN Alliance, Technical Report Version 02.00, March 2022.
  * [6] D. Mimran _et al._ , “Evaluating the security of open radio access networks,” _arXiv preprint arXiv:2201.06080_ , 2022.
  * [7] C. Shen _et al._ , “Security threat analysis and treatment strategy for ORAN,” in _2022 24th International Conference on Advanced Communication Technology (ICACT)_ , 2022, pp. 417–422.
  * [8] M. Kouchaki and V. Marojevic, “Actor-critic network for o-ran resource allocation: xapp design, deployment, and analysis,” in _2022 IEEE Globecom Workshops (GC Wkshps)_ , 2022, pp. 968–973.
  * [9] O-RAN, “O-RAN Control, User and Synchronization Plane Specification,” O-RAN Alliance, Technical Report Version 10.0, October 2022.
  * [10] A. S. Abdalla, P. S. Upadhyaya, V. K. Shah, and V. Marojevic, “Toward Next Generation Open Radio Access Networks–What O-RAN Can and Cannot Do!” _IEEE Network_ , pp. 1–8, 2022.
  * [11] A. Umesh, T. Yajima, T. Uchino, and S. Okuyam, “Overview of O-RAN fronthaul specifications,” in _NTT DOCOMO Technical Journal_ , vol. 21, no. 01, 2019, pp. 46–59.
  * [12] T. Mononen, T. Kause, S. Farrell, and D. C. Adams, “Internet X.509 Public Key Infrastructure Certificate Management Protocol (CMP),” RFC 4210, Sep. 2005. [Online]. Available: https://www.rfc-editor.org/info/rfc4210
  * [13] IEEE, “IEEE Standard for Local and Metropolitan Area Networks–Port-Based Network Access Control,” _IEEE Std 802.1X-2020 (Revision of IEEE Std 802.1X-2010 Incorporating IEEE Std 802.1Xbx-2014 and IEEE Std 802.1Xck-2018)_ , pp. 1–289, 2020.
  * [14] 3GPP, “Security Architecture and Procedures for 5G System,” Technical Specification (TS) 33.501, Version 15.2.0, October 2018.

## Biographies

Aly Sabri Abdalla<EMAIL_ADDRESS>is a PhD candidate in the Department of
Electrical and Computer Engineering at Mississippi State University,
Starkville, MS, USA. His research interests are on scheduling, congestion
control and wireless security for vehicular ad-hoc and UAV networks.

Vuk Marojevic<EMAIL_ADDRESS>is an associate professor in
electrical and computer engineering at Mississippi State University,
Starkville, MS, USA. His research interests include resource management,
vehicle-to-everything communications and wireless security with application to
cellular communications, mission-critical networks, and unmanned aircraft
systems.


###### Abstract

Quantum Chromodynamics predicts that the strong coupling strength $\alpha_{\rm
s}$ decreases with increasing energy or momentum transfer, and vanishes at
asymptotically high energies. The history and the status of experimental tests
of asymptotic freedom are summarised in this review.

##  Chapter 0 Look how it runs!

###  1 Introduction

Quantum chromodynamics (QCD) is the quantum field theory of the strong
interaction between quarks mediated by gluons. It is the strongest of the four
fundamental forces of nature: between quarks and at sub-atomic distances, the
strong interaction is a hundred times stronger than the electro-magnetic
force, $10^{14}$ times stronger than the weak force, and a mind-breaking
$10^{40}$ times stronger than gravity111A factor of $10^{40}$ corresponds to
the difference in size between the visible universe ($10^{26}$m) and an atomic
nucleus ($10^{-14}$m)..

QCD, exhibiting colour triplet quarks and colour octet gluons, was developed
and introduced by Harald Fritzsch, Murray Gell-Mann and Heinrich Leutwyler in
1972/1973 [1, 2]. One of the key features of non-abelian gauge theories (like
QCD), asymptotic freedom, was discovered by David Gross, Frank Wilczek and
David Politzer in 1973 [3]. Asymptotic freedom determines that the strong
coupling strength, $\alpha_{\rm s}$, “runs” with energy and asymptotically
vanishes at high energies. This allows to calculate physical quantities by
means of perturbation theory, in regions of energies where $\alpha_{\rm s}$ is
smaller than 1. After successful experimental verification of the running of
$\alpha_{\rm s}$, the discovery of Asymptotic Freedom was honoured with the
Nobel Prize in 2004 [4].

On the occasion of the Symposium in Memory of Harald Fritzsch held at the
Arnold-Sommerfeld Centre at Munich in July 2023. a personal (re-)view of
experimental tests of asymptotic freedom in QCD is given, recapping and
updating a more extended article that was published in 2006 [5].

###  2 Asymptotic freedom in QCD

In QCD, the energy dependence of the running coupling $\alpha_{\rm s}(\mu)$ is
given by the renormalisation group equation

$\beta(\alpha_{\rm s})=\mu^{2}\frac{d\alpha_{\rm
s}}{d\mu^{2}}=-(b_{0}\alpha_{\rm s}^{2}+b_{1}\alpha_{\rm
s}^{3}+b_{2}\alpha_{\rm s}^{4}+...)$ (1)

with

$b_{0}=\frac{11C_{A}-2N_{f}}{12\pi}\ ,$

where $C_{A}=3$ is the number of “colour” charges in QCD, and $N_{f}$ is the
number of quark flavours produced at the energy scale $\mu$. The higher order
coefficients $b_{1},\ b_{2},\ b_{3}$ and $b_{4}$ are also known to date, see
e.g. [6].

The “$-$” sign in front of the right-hand-side expression of eq. 1 establishes
asymptotic freedom, i.e. the running and decrease of $\alpha_{\rm s}$ with
increasing energy, as long as $N_{f}<17$.

In 1-loop (leading order) approximation, eq. 1 is solved by

$\alpha_{\rm s}(\mu^{2})=\frac{1}{b_{0}\ln(\mu^{2}/\Lambda^{2})},$ (2)

so QCD predicts that $\alpha_{\rm s}$ logarithmically decreases with
increasing energy scales $\mu$.

For a summary and discussion of higher order corrections, the role and
treatment of quark production thresholds and other peculiarities of QCD see
e.g. [5].

###  3 Experimental tests

Since the late 1980’s, studies of hadron jets and determinations of
$\alpha_{\rm s}$, in wide ranges of centre of mass energies and with
increasing experimental and theoretical precision, provided growing evidence
for asymptotic freedom. Equally important and equivalent to the running
coupling, evidence for colour charged gluons and the SU(3) gauge structure as
predicted by QCD provided key-indicators for the correctness of this theory
describing the dynamics of the strong interaction between quarks and gluons.

Figure 1: Energy dependence of 3-jet event production rates in hadronic final
states from $\rm e^{+}e^{-}$ annihilation, measured using the JADE jet finder
at a scaled jet energy resolution $y_{cut}=0.08$. They are compared to
theoretical expectations of QCD, of an abelian vector gluon model, and to the
hypothesis of a constant coupling strength.

####  1 Energy dependence of jet production rates

Studies of multi-jet event production rates in high-energy $\rm e^{+}e^{-}$
annihilation reactions, $\rm e^{+}e^{-}\rightarrow
q\overline{q}(g)\rightarrow\rm{hadrons}$, provided first evidence for the
energy dependence of $\alpha_{\rm s}$, before summaries of explicit
determinations of $\alpha_{\rm s}$ could provide a convincing case for
asymptotic freedom. These studies used hadron jets as footprints of the
initially produced quarks and gluons. They were based on the definition of
resolvable hadron jets which could be applied to both perturbative QCD
calculation and to measured hadronic final states:

Within the JADE jet algorithm [7], the scaled invariant pair mass of two
resolvable jets $i$ and $j$, $y_{ij}=M^{2}_{ij}/E^{2}_{vis}$ is required to
exceed a threshold value $y_{cut}$, where $E_{vis}$ is the sum of all
particles (resp. quarks and gluons) of the hadronic final state. Theory
predicts that - in leading order - the relative production rate of 3-jet
events is proportional to $\alpha_{\rm s}$,

$R_{3}=\frac{\sigma(\rm e^{+}e^{-}\rightarrow 3-jets)}{\sigma(\rm
e^{+}e^{-}\rightarrow hadrons)}=C_{1}\left(y_{cut}\right)\alpha_{\rm s}(\mu),$

plus higher order corrections $C_{2}(y_{cut})\alpha_{\rm s}^{2}(\mu)+\cal{O}$
$(\alpha_{\rm s}^{3})$, where the coefficients $C_{1}$, $C_{2}$ etc. are
constants, independent of the energy scale, and can be calculated in QCD
perturbation theory. Model studies showed that corrections due to non-
calculable hadronisation effects and to limited detector resolution and
acceptance are small.

The first study of the energy dependence of 3-jet event production rates, at
c.m. energies between 22 and 46 GeV, analysed for constant jet resolution
$y_{cut}$ at the $\rm e^{+}e^{-}$ collider PETRA, provided first evidence for
the energy dependence of $\alpha_{\rm s}$ in 1988 [8]. These data are shown in
figure 1, together with more results from experiments at the PEP, TRISTAN [9]
and finally, at the LEP collider [10]. The measured 3-jet rates significantly
decrease with increasing centre of mass energy, in excellent agreement with
the decrease predicted by QCD. The hypothesis of an energy independent
coupling, and especially the prediction of an alternative, QED-like abelian
vector gluon model, where gluons carry no colour charge, are in apparent
contradiction with the data.

Figure 2: Distribution of the azimuthal angle between two planes spanned by
the two high- and the two low-energy jets of hadronic 4-jet events measured at
LEP [13], compared to the predictions of QCD and of an abelian vector gluon
model where gluons carry no colour charge [11].

####  2 Gluon self-coupling and QCD group structure constants

The gluon self-coupling is a direct consequence of gluons carrying colour
charge by themselves, and is the essential feature leading to the prediction
of asymptotic freedom. Methods to directly detect effects of gluon self-
coupling are based on analysing distributions which are sensitive to the spin
structure of hadronic 4-jet final states, see e.g. [11]. The Bengtson-Zerwas
angle, $\chi_{BZ}$ [12], measuring the angle between the planes defined by the
two highest and the two lowest energy jets, is rather sensitive to the
difference of a gluon splitting into two gluons, which in QCD is the dominant
source of 4-jet final states, and a gluon splitting to a quark-antiquark pair,
which is the dominant process in an abelian vector theory where gluons carry
no colour charge.

The results of an early study which showed convincing evidence for the gluon
self coupling in 1990 [13], after one year of data taking at the $\rm
e^{+}e^{-}$ collider LEP, is shown in figure 2. The data clearly favour the
QCD prediction and rule out the abelian vector gluon case.

Figure 3: Determinations of the QCD colour factors $C_{A}$ and $C_{F}$ [14].

The QCD group constants $C_{A}$, $C_{F}$ and $N_{f}$, assume values of 3, 4/3
and 5 in a theory exhibiting SU(3) symmetry, with 5 quark flavours in the
vacuum polarisation loops. For alternative, QED-like toy models of the strong
interaction with U(1) symmetry, these values would be $C_{A}=0$ and
$C_{F}=0.5$. Experimental determination of these two parameters thus
constitute one of the most intimate tests of the predictions of QCD.

At LEP, data statistics and precision allowed to actually determine
experimental values for $C_{A}$, which basically is the number of colour
charges, and $C_{F}$. A summary of such studies, involving analyses of 4-jet
angular correlations and fits to hadronic event shapes [14], is presented in
figure 3. The data are in excellent agreement with the gauge structure
constants of QCD. They rule out the Abelian vector gluon model and theories
exhibiting symmetries other than SU(3).

####  3 Energy dependence of $\alpha_{\rm s}$

The straight forward way, clearly, is to determine $\alpha_{\rm s}(Q)$ from
data at different and large ranges of energy scales $Q$. $\alpha_{\rm s}$,
however, is not an observable by itself, but must be determined through
comparison of measurements of hadronic final states of high energy reactions
with QCD predictions of the dynamics of quarks and gluons. Such determinations
became available in the early 1980s, but their significance was rather
restricted due to limited statistical precision, limited precision of
theoretical calculations in only leading or next-to-leading order perturbation
theory, and the uncertainties in parametrising the hadronisation process, i.e.
the transition from quarks and gluons to observable hadrons.

Figure 4: Summary of $\alpha_{\rm s}$ determinations in the year 1989 [15],
with data from deep inelastic lepton-nucleon scattering (blue), heavy
quarkonia (green) and $\rm e^{+}e^{-}$ annihilation experiments (red).

The status of early determinations of $\alpha_{\rm s}$, as summarised in 1989
[15], is reproduced in Fig. 4. While being compatible with the QCD
expectation, the limited energy range, data statistics and theory precision,
at that time, were not yet sufficient to claim experimental evidence for the
running of $\alpha_{\rm s}$.

The situation rapidly improved with the start-up of the LEP $\rm e^{+}e^{-}$
collider at CERN in 1989. By 1992, LEP provided significant results on
$\alpha_{\rm s}$ at energies around the mass of the $Z^{0}$ resonance,
$M_{Z}\sim 91.2$ GeV/$c^{2}$, from hadronic event shapes from the decay width
of the $Z^{0}$-boson, and from hadronic decays of the $\tau$-lepton, at the
energy scale of $M_{\tau}\sim 1.78$ GeV/$c^{2}$ \- thus expanding the
available energy range by almost an order of magnitude. Precision and
reliability of theoretical calculations also improved by that time, in terms
of next-to-next-to-leading order (NNLO) precision for hadronic $Z^{0}$ and
$\tau$ decays, and resummation of NLO predictions for hadronic event shapes
and jet production rates. These ingredients gradually led to emerging evidence
for the running of $\alpha_{\rm s}$, in accordance with QCD and Asymptotic
Freedom, see e.g. [16] for a summary of $\alpha_{\rm s}$ results at that time.

[Summary of $\alpha_{\rm s}$ determinations in 2002 [17]]  [The running
$\alpha_{\rm s}$ from low energy PETRA to high energy LEP data [18].]

Ten further years later, by 2002 - about 30 years after the birth of QCD -,
increased precision of results from LEP, re-application of up-to-date analysis
methods and theoretical developments on past data from the JADE experiment at
PETRA, and precise results from lattice QCD calculations together provided
convincing evidence for the running of $\alpha_{\rm s}$, over a range of
energy scales from 1.7 to 214 GeV, in perfect agreement with the expectation
from QCD, see figs. 3 and 3. The evidence, at that point, was strong enough to
justify the award of the 2004 Nobel Prize in Physics to David Gross, Frank
Wilczek and David Politzer “for the discovery of asymptotic freedom in the
theory of the strong interaction” [4]. In fact, in the official advanced
information on the scientific background of this Prize [19], figs. 3 and 3 are
presented as $the$ experimental evidence for asymptotic freedom in QCD.

Figure 5: Summary of $\alpha_{\rm s}$ determinations in the year 2021 [20],
compared with the QCD prediction of the running coupling, in 4-loop precision
plus 3-loop matching at the charm- and bottom-quark thresholds.

The 2004 Nobel Prize was not the end of demonstrating asymptotic freedom in
QCD: many new and significant results were obtained since then - now about 50
years after the birth of QCD, and more than 30 years after Altarelli’s review
(c.f. fig. 4). Precise determinations of $\alpha_{\rm s}$ from lepton-hadron
collisions at HERA and from hadron collisions at the Tevatron and the Large
Hadron Collider (LHC) became available, now covering the huge energy range
from 1.7 to more than 2000 GeV. In many cases, experimental uncertainties are
at and below the one per-cent level. Theory predictions are up to the level of
N3LO, and lattice calculations also reached precisions of the order of one
per-cent and below. An up-to-date summary of all results [20] is reproduced in
fig. 5. It provides a very precise confirmation of the QCD prediction of
asymptotic freedom and the specific functional form of $\alpha_{\rm s}$
logarithmically decreasing with increasing energy scale, c.f. equation 2. No
other reasonable parametrisation can provide a similarly accurate description
of the data.

###  4 Conclusion

Fifty years after the foundation of quantum chromodynamics, the experimental
evidence for the key-feature of QCD, asymptotic freedom and the logarithmic
decrease of the coupling $\alpha_{\rm s}$ with energy, is overwhelming and
leaves no doubt on QCD being the gauge theory correctly describing the strong
interaction between quarks and gluons. As a well-tested and “proven” theory,
its predictive power now serves as an indispensable and reliable source for
defining and refining the “standard model” hadronic contributions and
background to many other precision studies, like electro-weak phenomena and
searches for new physics.

### Acknowledgements

Harald Fritzsch was one of the founding pioneers of QCD. Thank you Harald, for
your colossal contributions and lasting impact to the field!

## References

  * [1] H. Fritzsch and M. Gell-Mann, Proc. XVI Int. Conf. on High Energy Physics, Chicago-Batavia, 1972.
  * [2] H. Fritzsch, M. Gell-Mann, H. Leutwyler, Phys. Lett. B 47, 365 (1973).
  * [3] D.J. Gross, F. Wilczek, Phys. Rev. Lett. 30, 1343 (1973); Phys. Rev. D 8, 3633 (1973);
H.D. Politzer, Phys. Rev. Lett. 30, 1346 (1973).

  * [4] https://www.nobelprize.org/prizes/physics/2004/summary/
  * [5] S. Bethke, Prog. Part. Nucl. Phys. 58, 351 (2007); hep-ex/0606035.
  * [6] P.A. Baikov, K.G. Chetyrkin, J.H. Kühn, Phys. Rev. Lett. 118 8, 082002 (2017); 1606.08659 [hep-ph].
  * [7] W. Bartel et al. (JADE Collab.), Z. Phys. C33, 23 (1986).
  * [8] S. Bethke et al. (JADE Collab.), Phys. Lett B213, 235 (1988).
  * [9] S. Bethke, Proc. of the 23rd Rencontre de Moriond: Current Issues in Hadron Physics, Les Arcs, France, 1988, LBL-25247.
  * [10] S. Bethke,Nucl. Phys. Proc. Suppl., 54A, 314 1997, hep-ex/9609014.
  * [11] S. Bethke, A. Ricker and P.M. Zerwas, Z. Phys. C, 49, 59 (1991).
  * [12] M. Bengtsson and P.M. Zerwas, Phys.Lett B, 208, 3061988.
  * [13] B. Adeva et al. (L3 Collab.), Phys. Lett. B, 248, 227 (1990).
  * [14] S. Kluth, Proc. $10^{th}$ International QCD Conference (QCD 03), Montpellier, France, 2-9 Jul 2003; hep-ex/0309070.
  * [15] G. Altarelli, Annu. Rev. Nucl. Part. S. 39, 357 (1989).
  * [16] S. Bethke and S. Catani, Proc. of the XXVIIth Rencontre de Moriond, Les Arcs, France, 1992; CERN-TH.6484/92.
  * [17] S. Bethke, Nucl. Phys. B Proc. Suppl.121, 74 (2003); hep-ex/0211012.
  * [18] P. Zerwas, Eur. Phys. J. C34, 41 (2004).
  * [19] https://www.nobelprize.org/uploads/2018/06/advanced-physicsprize2004.pdf
  * [20] R.L. Workman et al. (Particle Data Group), Prog. Theor. Exp. Phys. 083C01 (2022).