Experimental Evaluation of a SOME/IP Firewall with Deep Packet Inspection for Autonomous Vehicles

Scalable Service-Oriented MiddlewarE over IP (SOME/IP) is one of the leading protocols that aims to replace the Controller Area Network (CAN) protocol in vehicles owing to its improved performance and security. However, vulnerabilities, such as malformed packets and injection attacks, are still present in SOME/IP, which can cause serious problems in autonomous vehicles. In this study, a specialised firewall solution is proposed to protect against logical attacks on the SOME/IP communication protocol, such as error-on-error or error-on-event attacks, by using header values to control and restrict access. Furthermore, malformed payload attacks are detected using a deep packet inspection (DPI) mechanism for basic payload validation. In order to evaluate the performance of the proposed firewall, datasets were prepared that comprised logical attacks and malicious payloads. The experimental evaluation of the proposed firewall was performed on a Raspberry Pi 4 Model B using the prepared datasets. The firewall was able to detect and prevent up to 79\% of malformed payload attacks with the used dataset. An optimal rule-set size was analysed, which observed no serious computational overhead impacts, even with up to 200 rules. Although the specialised firewall and deep packet inspection introduced an additional delay of 0.03ms-0.15ms, it is still acceptable for automotive use cases and shows the potential of the proposed firewall in future automotive use cases. This study also lays a foundation for future research in the field that can be built upon the results and dataset presented.