The integration of Scalable service-Oriented MiddlewarE over IP (SOME/IP) enables modern autonomous vehicles to function as distributed microservice clouds on wheels. However, treating the internal automotive network as a flat, trusted LAN is catastrophic: once an infotainment system or Wi-Fi module is compromised, the adversary can invoke remote procedure calls on safety-critical braking services. Stateful SOME/IP firewalls bring zero-trust microsegmentation into the vehicle.
Stateless packet filters merely inspect packet headers independently. An attacker can craft a fake SOME/IP response (`Message Type 0x80`) claiming that chassis speed is zero, tricking the door lock controller into popping locks while driving at 120 km/h. A stateful firewall maintains a dynamic in-memory table of active Request IDs (`Session ID + Client ID`). If an unexpected response arrives without an existing recorded request, the frame is instantly dropped and logged as a malicious spoofing attempt.