## 2 Background and Related Work
### Security for SOAs in Automotive Domain  
Today, SOAs already reached the maturity to be used in critical embedded applications [41, 42]. However, within the research sector, the topic of security for automotive SOAs is relatively new. To the best of our knowledge, only a few publications address these kinds of issues. In the following, we give a brief overview of existing ones. In 2017, a comprehensive security evaluation based on the SOME/IP protocol was conducted by [PERSON] [43]. The work starts with a Threat Analysis and Risk Assessment (TARA) to uncover possible attacks within an automotive on-board communication based on the SOME/IP protocol. As a result, 18 threats have been identified. The resulting risk analysis according to HEAling Vulnerabilities to Enhance Software, Security, and Safety (HEAVENS) [44] classifies 11 threats as high and three as critical. [PERSON] justifies the overall problem for the potential attack ways with the lack of security features in the SOME/IP protocol. Therefore, the author defines various use cases as well as associated security properties and discusses suitable security mechanisms. [PERSON] et al. [45] have started to discuss challenges and opportunities regarding an IDS for SOME/IP communication in vehicles. One challenge is the changed network behavior compared to established communication protocols such as CAN. The provider and consumer can decide autonomously to transmit any messages on the network. Therefore, the network traffic is more sporadically than periodic, and it is difficult to specify a normal behavior or detect abnormal network flows. Another challenge for an IDS is the property of reconfigurability, in case one network node is replaced by another due to a failure. As a result, a new network participant appears with new address information as well as changed network flows. The authors also mention the typical resource constraints on automotive gateways and thus limited possibilities for response in case of detected anomalies in realtime. However, there are also features of SOME/IP which represent unique characteristics (e.g., maximum registered SOME/IP providers or established connections on a specific service) compared to other automotive protocols. Moreover, the researchers propose in their work the first approach for an SOME/IP IDS by using these characteristics based on a predefined security policy (see Figure 3). The policy includes for example permitted services, which a specific provider can offer. Furthermore, the system is also able to support Intrusion Prevention System (IPS) functionalities (e.g., creating logs, alert messages for backends, termination of service calls). In their final evaluation, a lightweight implementation based on one security policy is shown. On the test platform used (Intel Core i7, Linux Ubuntu), verifying the policy causes an overhead of \(\upmu\)s.  
[PERSON] et al. [46] present a framework for securing the SOME/IP protocol, since the standard specification does not provide any security features. The framework defines three different security levels, which can be applied for services instances depending on their requirements regarding criticality. The first level (_nosec_) includes no specific security features but provides full compatibility with legacy services. The second level (_authentication_) comprises data authentication and integrity, which is verified by the middleware to guarantee message processing only from authorized sources. As a third level, (_confidentiality_ includes all security objectives of the second level as well as the capability to encrypt payload data. To specify the permitted traffic, the framework uses a traffic matrix including high-level policies with entries such as application, service, role, or minimum security level. The subsequent evaluation includes different analyses (e.g, network throughput, timing, and computation usage). One main result is that the authentication-level causes a 15-25% overhead. The use of encryption (third security-level) further increases the computation time.