Isolated Third-Party Applications in Existing SOME/IP-Networks

The software-defined vehicle paradigm is transforming the automotive industry, with software playing an increasingly important role. However, current vehicle OEM approaches are limited, relying mostly on first-party applications. Integrating third-party applications could unlock new opportunities for vehicle manufacturers and users, but this requires balancing access to in-vehicle signals and services, typically based on SOME/IP, with system sovereignty and security. To address this challenge, a novel concept integrates containerized third-party applications into existing vehicle networks, ensuring service isolation through virtualized, air-gapped SOME/IP networks provided by Linux containers and different virtual networks. This concept allows for configurable communication permissions through deployment configuration without imposing restrictions on third-party applications or requiring changes to the vehicle system. The concept was evaluated based on a proof-of-concept implementation, bridging an isolated application to an outside SOME/IP network. Through deployment configuration, the accessible services can be configured. The measured added round-trip latency is 1.07ms with the memory overhead being 40MB for messages under 5kB. The proposed secure integration of arbitrary third-party applications, controlled by the system administrator, allows for numerous new applications in software-defined vehicles. Additionally, re-usability and transfer across different systems are made easier, increasing the development efficiency of future automotive systems.