extfieldsofstudy:
Computer Science
Medicine

text:
Incomplete Information Management Using an Improved Belief Entropy in Dempster-Shafer Evidence Theory

Quantifying uncertainty is a hot topic for uncertain information processing in the framework of evidence theory, but there is limited research on belief entropy in the open world assumption. In this paper, an uncertainty measurement method that is based on Deng entropy, named Open Deng entropy (ODE), is proposed. In the open world assumption, the frame of discernment (FOD) may be incomplete, and ODE can reasonably and effectively quantify uncertain incomplete information. On the basis of Deng entropy, the ODE adopts the mass value of the empty set, the cardinality of FOD, and the natural constant e to construct a new uncertainty factor for modeling the uncertainty in the FOD. Numerical example shows that, in the closed world assumption, ODE can be degenerated to Deng entropy. An ODE-based information fusion method for sensor data fusion is proposed in uncertain environments. By applying it to the sensor data fusion experiment, the rationality and effectiveness of ODE and its application in uncertain information fusion are verified.

Introduction
Uncertain information processing is applied to complex systems in many fields, such as sensor networks [1,2], pattern recognition [3,4], and supply chain network management [5,6]. Dempster-Shafer (D-S) evidence theory [7][8][9] has a good performance in dealing with uncertain information, such as reliability assessment [10,11], pattern recognition [12,13], decision-making [14][15][16], and so on [17][18][19][20]. The sources of uncertainty information of D-S evidence theory include: (1) mass function of focal element, (2) non-zero mass function of empty set, and (3) uncertain information represented by possible incomplete FOD. Previously, many scholars have proposed many uncertainty measurement methods, which can identify the difference of uncertain information in probability framework to different degrees and are widely used in different fields. As the most widely used information entropy theory, Shannon entropy has been extended to a variety of fields, such as network entropy in complex networks [21] and gene enlargement analysis in the field of biological information [22]. Uncertainty measure for uncertain information management is a hot topic [23][24][25][26][27]. Entropy-based measure attracts lots of attention among researches [28,29]. Inspired by Shannon entropy, in the framework of evidence theory, many scholars have proposed methods in order to measure the uncertainty of evidence from different perspectives, such as Yager's dissonance measure [30], Deng entropy [31,32], and so on [17,33]. Meanwhile, some improved belief entropy based on Deng entropy has been proposed by scholars, such as Zhou et al.'s entropy [34] and Cui et al.'s Ω = {Θ 1 , Θ 2 , ..., Θ i , ..., Θ N } .
(1) Definition 2. The power set of Ω, denoted as 2 Ω , which is composed of 2 N elements, is defined, as follows: Definition 3. For Ω, a basic probability assignment(BPA)(or mass function) is a mapping m: 2 Ω → [0, 1], which satisfies the following properties: If m(A) > 0, the subset A is called a focal element and m(A) > 0 is the mass function value of proposition subset A.

Definition 4.
A body of evidence (BOE) is a component unit of uncertain information based on FOD, power set of FOD, and mass function. A BOE is a binary group of proposition subset and corresponding mass function, which is defined as: where is a subset of the power set 2 Ω .

Definition 5.
For Ω, the belief function Bel or the plausibility function Pl, is defined as Definition 6. In Dempster-Shafer (D-S) evidence theory, Dempster's rule of combination can fuse two independent mass functions m 1 and m 2 : where k is a normalization factor defined, as follows: It is worth noting that the classical definitions of DST are defined and used in the closed world.

Definition 7.
In the open world hypothesis, Dempster's rule of combination is extended by Deng in [31]. The intersection of empty set and empty set is still empty set, which satisfies condition φ 1 ∩ φ 2 = φ. Given two BPAs (m 1 and m 2 ), the generalized combination rule is defined, as follows: m(φ) = 1 i f and only i f K = 1.

Shannon Entropy and Belief Entropy
Definition 8. As the most widely used information entropy theory, Shannon entropy has been extended to many fields, such as network entropy in complex networks [21] and gene enlargement analysis in the field of biological information [22]. Shannon entropy is defined as [43]: where N is the number of basic states, p i is the probability of state i, and p i satisfied ∑ N i=1 p i = 1.

Definition 9.
Deng entropy was proposed in [31] based on Shannon entropy. Some properties and behaviors are discussed in [31,44]. Deng entropy is defined as [31]: where |A| represents the cardinality of the proposition A. According to [31], there are some advantages in Deng entropy when compared with other methods. However, Deng entropy also has some significant disadvantages. For example, Deng entropy does not take into account the influence of the size of the FOD and the intersection of different proposition subsets [35], and it cannot be applied to incomplete FOD.

Definition 10.
As an improvement on Deng entropy, Cui et al.'s entropy was proposed in [35]. When compared with Deng entropy, the improved entropy in [35] takes the influence of the size of the FOD and the intersection of different proposition subsets into account. Cui et al.'s entropy is defined as [35]: where |A| represents the cardinality of the proposition A, X is the frame of discernment, |X| denotes the certain element number in the frame of discernment, and |A ∩ B| is the cardinality of the intersection of A and B. Although Cui et al.'s entropy is optimized for Deng entropy, according to [45], Cui et al.'s entropy still has some obvious problems, such as its lack of subadditivity, additivity, and monotonicity.

The Improved Belief Entropy
In this part, we define a new belief entropy for incomplete and uncertain information measuring based on Deng entropy named Open Deng entropy (ODE). On this basis, a sensor data fusion method is proposed and its advantages as compared with other methods are discussed in Section 4.

The Open Deng Entropy
The Open Deng entropy (ODE) is defined as follows: where X is the frame of discernment, |X| represents the number of elements identified in the FOD, |A| denotes the element number in proposition A, the open world characteristic factor of D-S evidence theory is a newly proposed parameter. Through the open world characteristic factor, the ODE can include the non-zero mass function of the empty set and the uncertain information expressed by the possible imperfection of the FOD. The basis of the open world characteristic factor is as follows.
• The parameter m(φ) represents the value of mass function of empty set, and parameter |X| is the potential of the FOD. In the evidence theoretical framework, the two have clear physical meanings. • When the information space degenerates from the open world to the closed world, the value of the empty set mass function is 0, which keeps good compatibility with the improved Deng entropy method. Property 1. semantic consistency with evidence theory. ODE is defined based on mass function, the frame of discernment and its potential in the evidence theory, propositional subset of the FOD, and its potential and empty set, which does not involve the loss of semantic consistency with the evidence theory caused by mass function and probability function conversion in the closed world described in literature [40], so the ODE satisfies the semantic consistency with the evidence theory. |X| is always not greater than |X| ) is never greater than 0. Therefore, the Open Deng entropy satisfies the value non-negative characteristic.

Property 3. probabilistic consistency. When proposition A is a subset of a single element, the ODE is reduced to
, which is fully compatible with the characteristic of Thomas Bayes probabilistic information of Shannon entropy measurement and has probability consistency. When proposition A is the empty set representing incomplete information under the assumption of open world, the confidence uncertainty of the mass function of the empty set and the size of the FOD affect the expression of probability consistency.
The above three properties are completely consistent with Deng entropy. ODE and the improved entropy in [35] are both improved based on Deng entropy, but there are some differences between them. Cui et al.'s entropy is an improvement of Deng entropy when considering the influence of the size of the FOD and the intersection of different proposition subsets [35]. In contrast, the ODE improves Deng entropy by taking into account not only the size of the FOD, but also the non-zero mass function of empty set, so that the ODE can be applied to incomplete FOD, which shown in Example 3 and

Numerical Example and Discussion
In this example, the mass function of the empty set is 0, which shows that the mass function is distributed in the closed world. Shannon entropy H, Deng entropy E d , and ODE E ode are calculated, as follows: In this example, the mass function of the empty set is 0, which indicates that the mass function is distributed in the closed world. Shannon entropy H, Deng entropy E d , and ODE E ode are calculated, as follows: From the measurement results of evidence uncertainty in the above two examples, it can be found that the mass function of the empty set is 0, which is, under the condition of the closed world, the ODE is reduced to the Deng entropy, and the calculated results are consistent with the results of the Deng entropy and Shannon entropy measurements. However, the mass function of the empty set in the open world is not zero, so Shannon entropy and Deng entropy are no longer applicable. At this time, we can only adopt the method of this chapter.

Example 3.
In a changing FOD |X|, the given mass function is as follows: The BPA of an empty set is 0.5, which is non-zero, which indicates that the mass function is allocated under open world conditions. The uncertainty measurement results of Shannon entropy H, Deng entropy E d and Open Deng entropy E ode varied with the changing FOD |X|, as shown in Table 1 and Figure 1. The measurement results show that, even if we regard the empty set proposition as a special uncertainty proposition with non-zero mass function assignment, Shannon entropy H can be used to calculate this example, the measurement results cannot reflect the change of potential in the FOD. Because the BPA of the empty set is non-zero, the Deng entropy cannot be applied in this example. Obviously, the Open Deng entropy can be used to E ode (m) indicate that, as the FOD |X| expands, the value of the measurement of evidence uncertainty gradually increases.

Application in Sensor Data Fusion with Incomplete Information
This section proposes a conflict data fusion method that is based on the uncertainty of Open Deng entropy measurement information to illustrate the applicability and effectiveness of Open Deng entropy in information fusion. Figure 2 designs the framework of open world uncertain information fusion method based on Open Deng entropy. Detailed process description of steps in Figure 2 are as follows.
Step 1: in the open world, there is a lot of uncertain information in the practical application of BPA modeling. To address the uncertain information systematically and objectively, in the framework of Dempster-Shafer evidence theory, the first step is to use BPA to model the uncertain information.
Step 2: use Open Deng entropy to measure the uncertain information of BPA before further processing the data, it is necessary to use a reasonable and applicable uncertainty measure to measure the uncertainty of the information modeled by BPA in step 1. In this method, the uncertain information is measured by the Open Deng entropy. The uncertainty that corresponds to ODE is calculated, as follows: Step 3: calculate the weight of each evidence function and modify the mass function based on the weight. The weight of each evidence function can be calculated according to the value of the ODE. The specific formula is as follows: As the data preprocessing before evidence fusion, the weighted mass function of each proposition should be calculated by weight. The weight mass function mass is calculated, as follows: Step 4: data fusion using Dempster's combination rule. This method use Open Deng entropy to transform and measure the conflict between different evidences, and the combination rule of Dempster is used to complete the data fusion. The combination result of each proposition A can be obtained through (n − 1) Dempster's combination rule: Step 5: apply the method to engineering applications that need decision analysis. The fault diagnosis experiment of motor rotor in literature [41] is taken as an application example, and its fault characteristics are extended to make it have the characteristics of open world. Among them, there are three fault modes in the rotor of the motor, F1 means the rotor is unbalanced, F2 means the rotor is out of alignment, and F3 means that the support is loose. Three vibration acceleration sensors were placed in different installation positions in order to collect vibration signals. The frequency amplitude of acceleration vibration at three different frequencies of Freq1, Freq2 and Freq3 is known as the fault characteristic variable. {F1, F2, F3} incomplete framework for fault identification. After modification of the data in the literature modeling results [41], it is expanded from the closed world to the open world. Table 2 shows the failure data reported by sensors at different frequencies. Table 2. Data for fault diagnosis modeled as BPAs [46].

Uncertainty Measure of BPAs with ODE
Different sources of information, such as the different sensors in this example, can yield data of different reliability. Therefore, the uncertainty of the mass function of evidence modeled can be measured by the proposed Open Deng entropy. For example, for the evidence modeling results of accelerated vibration frequencies Freq1, Freq2, and Freq3, the uncertainty measurement results are shown in Table 3 according to the entropy measurement formula of the open world described in Equation (16).
As for the uncertainty measurement results that are mentioned in Table 3, for the acceleration vibration frequency Freq1 and evidence E ode (m s1 ), the calculation equation is as follows:

Mass Function Data Modification Based on ODE
The uncertainty measurement results presented in Table 3 are used for evidence data modification. Using the ODE calculation results as the weighting factor of each sensor report. After normalization, the weights of each group with a small acceleration vibration frequency of Freq1 are calculated, as follows: w s2 = 0.3382, w s3 = 0.2427.  Based on the weight factor in Table 4, it is applied to the following mass functiondata modification formula: For the example of acceleration vibration frequency Freq1, the modified mass function is calculated: The calculated results are shown in Table 5 for the modified mass function under different vibration acceleration frequencies.

Data Fusion Based on Generalized Rules of Evidence Combination
In the open world, since the mass function of the empty set is no longer 0, the classical Dempster combination rule under the hypothesis of the closed world is no longer applicable, so the generalized evidence combination rule [9] is adopted for evidence fusion.
Two generalized evidence combination rules are needed to fuse the revised three groups of the same mass function values. The calculation results of frequency Freq1 are as follows: Table 6 and Figure 3 show the fusion results at different frequencies. The fusion results of Open Deng entropy and generalized evidence combination rule show that F2 has the highest confidence support level under any test frequency condition. Therefore, we can determine the fault type to be F2. Moreover, according to Table 6 and Figure 3, by comparing different methods, we can clearly see that the data fusion results of the proposed method are consistent with those of other literature, which verifies its effectiveness. In addition, the data fusion results of this method have a higher level of confidence support for the fault conclusion, which is more conducive to the application in practical engineering.

Conclusions
In this paper, an uncertainty measurement method that is based on Deng entropy named ODE is proposed. This method is not only compatible with Deng entropy, but it can effectively quantify the uncertainty of closed and open world. Meanwhile, this method takes into account the sources of uncertain information in the Dempster-Shafer evidence theory framework that are not considered by other existing methods, including the uncertain information brought by the incomplete FOD and the non-zero mass function of empty set. In addition, the proposed method takes into account the sources of uncertain information in the Dempster-Shafer evidence theory framework that are not considered in some existing methods, including the uncertain information brought by the incomplete FOD and the non-zero mass function of empty set. An information fusion method is designed based on the ODE in order to verify the validity and applicability of ODE. Examples and applications verify the rationality and validity of the method. In addition, the limitations and problems of this method are discussed in the open world.
There are still some open issues worthy for further discussion on the ODE. The first problem is that the proposed ODE only considers the mass function of a non-zero empty set as the characteristic factor in the calculation formula, and it does not measure the uncertainty information of the mass function of a non-zero empty set separately. The second problem is that the ODE satisfies the nature of Deng entropy. However, it is also not fully satisfied the characteristics of "set consistency", "sub-additivity", and "additivity". The following work should address more reasonable properties in the open world assumption.

Conflicts of Interest:
The authors declare no conflict of interest.


Advancement in infotainment system in automotive sector with vehicular cloud network and current state of art

Received Apr 25, 2019 Revised Oct 18, 2019 Accepted Nov 3, 2019 The automotive industry has been incorporating various technological advancement on top-end versions of the vehicle order to improvise the degree of comfortability as well as enhancing the safer driving system. Infotainment system is one such pivotal system which not only makes the vehicle smart but also offers abundance of information as well as entertainment to the driver and passenger. The capability to offer extensive relay of service through infotainment system is highly dependent on vehicular adhoc network as well as back end support of cloud environment. However, it is know that such legacy system of vehicular adhoc network is also characterized by various problems associated with channel capacity, latency, heterogeneous network processing, and many more. Therefore, this paper offers a comprehensive insight to the research work being carried out towards leveraging the infotainment system in order to obtain the true picture of strength, limitation, and open end problems associated with infotainment system.

. Difference between cloud and cloud with vehicular network Figure 3. Vehicular cloud service architecture The conventional vehicular cloud service architecture ( Figure 3) consists of only three layers. The bottom layer is Infrastructure as a Service which is meant for storage, connectivity with data center etc. The middle layer is for Platform as a Service which is integrating with the conventional IEEE standard of vehicular adhoc network. The top layer is for Software as a Service which is basically meant for infotainment system as well as vehicle-to-vehicle communication, as well as different other application of vehicular cloud system.

EXISTING RESEARCH CONTRIBUTION
From the discussion made in prior section, it can be seen that there are various forms of network services being run within an infotainment system of a vehicle. Network plays a very significant role in the process of relaying services. At present, there are various research work being carried out towards leveraging infotainment system over a vehicular network and this section briefs of all the significant literature addressing the problem. The existing system has been found to be classified into two core methods towards development of infotainment system which is discussed as below:

Infotainment system over vehicular networks
The betterment of services offered in infotainment system can be only facilitated by as faster wireless communication system. Radio over Fiber (RoF) based approach is proven to for faster communication with the road-side units harnessing the concept of IoV which is also characterized by multiple interfaces of communication system. This approach was seen in the work of Sherazi et al. [16] where multiple vehicles perform group-based communication under defined radio access units. All the access units are integrated with a control system that uses optical fiber to establish connection with its backbone cloud network. Multiple test environments are used for assessing its outcome with respect to throughput, load, delay, etc. Usage of open source is also carried out towards developing an interface application of infotainment system. The main idea behind adding such interface is that existing design of infotainment system are developed on different platform and hence is always dependent on specific form of application to be executed within it. Therefore, the work of Kovacevic et al. [17] proved this concept by using java toward building an application interface followed by developing a prototype application. Apart from the problem of data forwarding and service transition, it was seen distribution of data in large scale, mobility, and sensitivity to delay is another set of problems in infotainment system. According to Guo et al. [18], all these problems can be sorted by compressed sensing methods. This method is reported to assists in video streaming, recognition of object, sensing vehicle crowd, security and privacy protection, estimation of road traffic system, tracking object, etc. However, they are too associated with various challenges e.g. hardware design, analysis of behaviour on-road, streaming data, etc. Service relaying over infotainment system is also facilitated by using Wi-Fi protocol, however, it suffers from interference problem and can significantly affect the data to be received in infotainment device. Study towards this direction is carried out by Na et al. [19] has discussed various approaches to control interference problems e.g. channel hoping approach, power control policy, infra-structured based cooperation with adjacent nodes, etc. Authors have presented a simulationbased study with two different case studies to solve interference problems. The study outcome shows that presented scheme offers better throughput. There are some studies when conventional approaches have been used quite uniquely to offer better infotainment services. It has been reported that usage of television bands can facilitate better relaying of service. The work carried out by Chen et al. [20] has specified that reusing the spatial spectrum can assist in relaying data for infotainment services. However, the only difference it makes with other conventional approach is that-conventional approaches data is restricted to core internet network (i.e. cloud) whereas the presented scheme forwards the data to application server and geo-location database server. The work carried out by Rene et al. [21] have emphasized on adoption of emulation towards investigating infotainment system associated with the vehicular network. The authors have discussed a real-time emulation platform called as Vespa for this purpose and discussed various analytical capabilities of this emulator. Different from main-stream studies, there is a study conducted by Tian et al. [22] that discusses about the problem associated with the position of display for the infotainment device. The complete study has been carried out considering multiple display position to find that fluctuation on the position of lane could be minimize considering position with cluster display. The multiple display position considered was on radio interface, phone interface and HVAC (Heating, ventilation, and air condition) interface. Abdullah et al. [23] have used raptor codes in order to assess the relaying services along with using decode and forward scheme. A simulation-based scheme was adopted over conventional IEEE standard of VANET as well as design of MAC layer to find increase in its throughput. Another form of such non-conventional approach was carried out by Cheng and Trivedi [24] where gesture recognition is used for improving the driving experience over new form of hands-free infotainment system. The scheme make use of vision-based computational model where supervised learning scheme along with denoising scheme has been used for training the system to understand hand gestures. The work carried out by Galarza et al. [25] has presented an adaptive scheme to develop an interface for machine and human interaction in presence of dynamic scenarios of driving. A prototyping has been carried out for this purpose to check its statistical outcomes. However, direct applicability as well as work towards developing infotainment system is restricted only till this much of research papers and no further significant research work found till now.

Integration cloud with vehicular network
In order to support various services and application over the infotainment system over vehicular network, there is a potential need of a distributed and large network which is also ubiquitous in nature. Hence, cloud is one of the most preferred backbone or core network that can solve maximum problems associated with the accessing diversified services in vehicles [26]. As cloud offers extensive scheme for supporting various services, therefore studies towards combined usage of cloud and vehicular network is classified into three types on the basis of the existing research trends: a. Schema-based Approaches: This kind of approaches makes use of unique schemes and planning in order to improve the service accessibility over vehicular network that can indirectly improve the performance of infotainment system. However, it should be known that such studies do not directly target towards infotainment system; however, their outcomes are claimed to offer better supportability towards challenging services accessed using infotainment system over vehicular network. Most recently, the work carried out by Shah et al. [27] discussed that transmit-power has prominent effect as well as it also has direct connectivity with the state of congestion in vehicular network. Hence, the solution offered by author was by using game theory for developing an adaptive scheme for congestion control considering transmit-power. It was also seen that usage of fog computing too offers advantage to vehicular cloud network. One such usage can be found in the work of Tang et al. [28] where fog computing is used for smart parking system using experimental approach over vehicular network. A typical algorithm is written for exploring the free parking slot using multiple optimization objects. The analysis of the study is carried out using cost over space of parking. However, the study doesn't consider many other essential elements e.g. information and domain related systems and is focused only on specific information. Emphasis on information as well as domain related schemes has been theoretically discussed by Grewe et al. [29] using different use cases. The study reveal that existing approaches using such schemes have diversified differences with respect to mechanism of data dissemination, naming, or security, etc; however, all the approaches offer equal emphasis to the mobility problems. Moreover, the impact of data offloading is not much found to be discussed in this work. It is believed that data offloading results in challenging situation of data explosion over wireless network and hence a control scheme is required. The study towards addressing this problem was carried out by Huang et al. [30] where an integration of mobile edge computing and software defined network has been utilized to develop a control scheme. This scheme allows a formulation of better route for vehicle-tovehicle communication scheme using contextual information. It should be noted that majority of such system is basically operational over IP network which doesn't offer suitability for any form of contentcentric network. Hussain et al. [31] claimed that if such IP network is connected with vehicular cloud network that such problems could be resisted. Existing system also offers a scheme for catering up demands of autonomous vehicles. The work carried out by Maalej et al. [32] uses computer vision in order to develop a multimodal scheme for identification of object by the vehicle followed by recognition of it. A hypothetical scheme towards improving vehicular cloud has been also emphasized by Gong et al. [33] and Huang et al. [34]. Study towards resource allocation for effective heterogeneous vehicle is carried out by Lin et al. [35] using Markov modeling. The work of Quan et al. [36] has emphasized on improving the delivery quality by packetizing the multimedia file content over vehicular cloud network. The authors have used Markov chain for system model. A storage scheme was presented by Wu et al. [37] where it targeted for transmitting the data to a different vehicular node prior to transmitting the data to particular zone. Fuzzy logic was utilized and cluster-based method is used for transmitting the data. The problem associated with the energy efficiency and the quality of experience is investigated by Xu et al. [38]. The work of Girau et al. [39] have presented a discussion of reusability of different layers considering IoT for developing a social platform of all the objects that are connected to each other. The work carried out by Kim et al. [40] has presented discussion on the solution towards the data forwarding scheme. The scheme uses greedy algorithm as well as learning scheme in order model data dissemination process. Li et al. [41] have presented a discussion of a scheme that uses smart phone for facilitating routing scheme on vehicular network. Adoption of game theory is also seen in the work of Zhang et al. [42] towards intelligent transportation system. The mechanism introduces a trajectory-based system to establish communication among the vehicles. A search-based approach is developed by Mershad and Artail [43] where an efficient cloud server is looked for. b. Security-based Approaches: Owing to the utilization of the diversified adhoc network in highly distributed fashion, the communications within the vehicular nodes are highly vulnerable. Hence, security is of higher degree of concern when it comes to vehicular cloud network. The consequences of security breach can cost the life of a driver by remotely tampering the infotainment system. As infotainment system also retains various private information about the vehicle owner, hence privacy is always of higher concern. Most recently, the work carried out by Huang et al. [44] have addressed such security problems quite uniquely. A security schema is designed that is capable of resisting all sorts of negative messages or counterfeited messages. The work carried out by Yang et al. [45] have used game theory in order to compute the channel capacity associated with different vehicles for controlling the security breach and make the communication more efficient. Problems associated with the privacy problems are discussed by Xue et al. [46]. The authors have used encryption based mechanism using fog computing to perform prediction of mobility of vehicular nodes to fog server. Shao et al. [47] have presented a privacy protection scheme over vehicular cloud network by combining digital signature scheme and tree-based authentication mechanism. Another study over privacy problem is addressed by Ni et al. [48] where a navigation assistance system has been designed. The technique uses Bloom filter for retrieving the data for supporting querying system and a mathematical model is presented using digital signature which ensure validation and updating of all the vehicular nodes. Solution towards data stealing problems from infotainment system can be resisted of the vehicular communication is safeguarded with fail-proof mechanism. Study towards such direction was carried out by Luo and Ma [49] where multi-authority scheme of attribute based cryptography has been implemented for controlling access on the vehicles. Study towards emphasis on data security has been presented by Li et al. [50]. According to the study, over channel utilization, is one indicator of security breach and existing security approaches doesn't offer comprehensive security solution. The study carried out by Fan et al. [51] have discussed that mobility with high speed and distribution of node with high density can significantly affect data forwarding as well as may invite security problems too. Therefore, the solution presented by authors is based on retrieving the ciphertext with higher efficiency. The problem associated with the privacy problem is also addressed in the work of Hussain et al. [52]. An interesting solution has been presented by the author where images are captured from the site of interest by the image capturing devices of the vehicles and the information is forwarded to the cloud. The capturing of image is carried out only when the vehicular node encounters any event. An incentivebased mechanism is introduced in order to promote participation of many vehicles. The works carried out by Soleymani et al. [53] have presented a trust-based framework in order to maintain the reliability and integrity among the vehicular nodes. Harnessing fuzzy logic, the model is capable of checking the validity often messages exchanged by the vehicles. Usage of message authentication codes is also reported for ensuring better anonymity of the messages exchange in vehicular networks. The work of Jiang et al. [54] has used hash message authentication codes for performing authentication of list of revoked certificate. The implementation has used pseudonym for strengthening the privacy factor too.
A unique study carried out by Zhou et al. [55] have used delay tolerant network in order to resist the node compromise attack. The study also shows that it can offer equal performance towards data delivery performance too apart from security. Another unique study was proposed by Liu et al. [56] where a downlink dissemination of the message is presented. According to the study, the delivery of the secured messages are offered with higher priority using specifically defined gateways followed by message dissemination among the vehicle. c. Traffic-based Scheme: Traffic-based scheme is another approach which has been implemented by some of the researchers. The prime motive of this kind of approach is to basically to develop a unique topological policy which has a direct impact on the traffic system of vehicular network. Majority of such scheme make use of directionality factor and various conditional options for allowing the traffic. Most recently, there was no such approach and the only latest approach in this regard is found in the year 2016, where Azizian et al. [57] have presented a transmission scheduling. In such schemes sensor has been utilized for scheduling by using a cluster formation approach for newly forming vehicular cloud dynamically and not in predefined fashion. Calculation towards relative mobility is carried out for selecting the broker node. The approach uses medium access control using contention free approach. Usage of cooperative relaying also assists in formation of a new traffic system for an efficient service relaying over infotainment system in vehicular cloud networks. The work carried out by Feteiha and Hassanein [58] has discussed about the cooperative relaying mechanism over 4G networks. According to the authors, existing relaying scheme suffers from performance degradation that adversely affects the data arriving on the infotainment device while using existing vehicular cloud system. It also suffers from more degree of channel related errors. Therefore, the presented scheme uses cooperative technique with pre-coded scheme which is meant for extracting the spatial diversity information of 4G network. Adoption of this scheme is claimed to enhance the traffic system among the node communication.
According to Salahuddin et al. [59], the contribution of software defined network is essential for framing up the traffic system of vehicular cloud. The authors have presented an architecture where a unique road side unit is developed for dynamic traffic management. Therefore, it can be seen that there are various forms of algorithms as well as approaches which directly as well as indirectly assists in enriching the operation of infotainment system. The direct systems are developed towards infotainment system while the indirect systems are developed towards improving the vehicular cloud system which can directly contribute to support the better performance of infotainment system. Table 1 summarizes all the existing research contribution.

OPEN END PROBLEMS OR RESEARCH GAPS
There is no denying the fact that existing research contribution discussed in prior section has given a considerable edge of features towards infotainment system. However, majority of the problems are associated with the loopholes which are yet to be investigated. Following are some briefing of the open end problems extracted after reviewing the existing system: a. Bias focus on Problems: In order to offer a superior form of service relaying on infotainment system, it is required that existing research contribution should offer better quality of service, flexible form of modeling, resistivity capability against all form of potential threats, and capability to deal with all sorts of traffic / network related issues. Unfortunately, majority of the research work are focused on security problems and least on other quality of service problems. The operation carried out by an infotainment system demands a complete supportability of vehicular cloud network which has many other problems critical than security problems. Even from security solution discussed, they are not meant for dynamic adversarial attack but are quite specific to one form of attacks. Moreover, maximum approaches have no evidence that they are also effective towards data delivery performance along with security. Hence, there is a long way to go ahead even to obtain a better form of security solution. b. Doesn't Cater up Actual Demand of Infotainment System: A robust and better form of infotainment system can be only said if they have complete support of minimal latency, offers optimal bandwidth, and maximum retention of connectivity among the vehicles. Although, there are many literatures that claims of lower delay, but they are not found to claim for other performance factors which are equally essential to prove the supportability of futuristic infotainment system. Without lower latency, it is not feasible to support delivery of massive streams of contents while maximum channel capacity is required for seamless uploading of necessary back end services and data to offer online loading of dynamic services. Similarly, seamless connectivity is highly essential as infotainment system for upcoming driverless vehicle requires non-intermittent and fail-proof connectivity. There is no such literature where all these problems are sorted out in reality. c. Lack of consideration of Infotainment Device: Basically, an infotainment device is a part of the on-board unit in intelligent transportation system. In order to offer better service supportability with better quality of experience, it is required that all the capability factor associated with radio communication of the vehicle should be considered e.g. adopted channels for radio frequency, radio communication using single/multiple hops, bit rate, available channel capacity, degree of compensation towards propagation issues for radio signals, etc. In existing system, all these factors are considered only for road side units and never for on-board units. d. Non-Applicability to Road Transport System: A closer look into various scheme-based approach as well as traffic-based approach shows good conceptual model but without any evidence of their applicability to road transport system. It was seen that majority of the research contribution under this uses data dissemination process using unicast and broadcasting scheme. The unicast mechanism uses trajectorybased, stability factor of link, and geographic-based. Such approaches results in vehicle to fail in exploring the next vehicular node to perform forwarding because network related global knowledge is not provided to the vehicles. For this, the data dissemination schemes are not equipped with global data.

2085
Apart from this, existing approaches of data dissemination on vehicular cloud are carried out on specific network model which is pre-configured. e. Unrealistic Test Environment & Modeling: Basically, the service to support infotainment requires massive flow of information. Therefore, real-time usage of infotainment system is shrouded with different challenges due to maximum transmission rate of data along with adaptability of dynamic topology. This requires a joint accomplishment of interference-free network, higher bandwidth, lower resource consumption, etc. Unfortunately, all these are hard to achieve at same time as per existing approaches without which it is not feasible for achieve superior quality of streamed data. Existing studies towards multimedia streaming doesn't deal with contention problem as well as they also lack resisting problems like congestion and collision. f. Lack of Optimization Approach: There are no research works carried out towards optimization.
At present, there are various optimization algorithms dealing with wide range of scientific problems. Even in cloud computing, machine learning is slowly increasing in almost all the application to offer better optimized outcomes in order to meet user demands. Unfortunately, the research work using optimization based approach is significantly missing which has capability to solve maximum problems.
There is an immense need of novel optimization technique to find best solution for supportability of seamless services on infotainment devices using vehicular cloud network.

CONCLUSION
This manuscript discusses about the actual scenario of infotainment system in vehicular network. After reviewing the existing studies it is just concluded that there are lot of scope of work to be carried out over vehicular cloud system with more emphasis on comprehensive computational model. Existing work can be just treated as a better form of guidelines to start a new work with more exposure towards achievements as well as limitation. The contribution of the this manuscript is that it offers better idea of Advancement in Infotainment System in Automotive Sector with Vehicular Cloud Network by introdcing the basic fundamentals of the infotainment system along with gaps in the research area of Automotive Sector with Vehicular Cloud Network. The future work could be on the direction of the addressing the open end issues discussed in prior section. A novel computational model can be constructed with inclusion of real-time non-linear constraints so that maximum problems associated with robust and efficient service supportability towards infotainment system can be developed.


extfieldsofstudy:
Computer Science
Engineering

text:
Achieving Fair Random Access Performance in Massive MIMO Crowded Machine-Type Networks

The use of massive multiple-input multiple-output (MIMO) to serve a crowd of user equipments (UEs) is challenged by the deficit of pilots. Assuming that the UEs are intermittently active, this problem can be addressed by a shared access to the pilots and a suitable random access (RA) protocol. The strongest-user collision resolution (SUCRe) is a previously proposed RA protocol that often privileges the UEs closer to the base station (BS). In contrast, we propose a novel RA protocol using a decentralized pilot power allocation method that aims at a fairer performance. The proposed access class barring with power control (ACBPC) protocol allows each UE to estimate, without additional overhead, how many UEs collided for the chosen pilot and calculate an ACB factor, which is then used to determine the pilot retransmission probability in the next protocol step. The results show that the proposed ACBPC protocol is superior to SUCRe in terms of providing a fair connectivity for very crowded networks, although still being distributed and uncoordinated as the original SUCRe protocol.

I. INTRODUCTION
In 5G networks, it is envisaged that roughly 7 billion of devices will be connected across the world by cellular technologies [1]. Massive multiple-input multiple-output (MIMO) techniques can be successfully used to improve the performance of random access (RA) in such crowded networks [2]- [6]. Among them, the inventive strongest-user collision resolution (SUCRe) protocol [2], by exploiting the intrinsic properties of favorable propagation in massive MIMO, offers a distributed RA solution that can resolve up to 90% of collisions, while being able to serve a large number of users.
The good performance of SUCRe led to the proposal of several variants, as [3]- [5].
Common to them, in the first step the user equipments (UEs) transmit randomly selected pilots. In SUCRe, only the strongest UE (the UE with the larger average channel gain) in a collision is allowed access to the select pilot and retransmits it in the third step. The other UEs in the collision wait until the next access attempt. In SUCRe combined idle pilots access (SUCR-IPA) [3], the base station (BS) detects the set of pilots that are unused in step 1 and transmits their indices with an access class barring (ACB) factor in the second step, hence creating an opportunity for the weakest UEs to access those unused pilots in the third step.
SUCR-IPA outperforms SUCRe at the cost of increased control overhead. SUCRe combined with graph-based pilot access (SUCR-GBPA) [4] also announces the indices of non-used pilots in the second step, but not an ACB factor. Then, those UEs not apt to transmit data with the original selected pilot, randomly select another from the non-used pilots broadcasted by the BS. A bipartite graph can be constructed by setting the active UEs as the variable nodes and the chosen pilots as the factor nodes. A successive interference cancellation is used to estimate the channel of each UE. Through the idea of retransmission probability, a soft decision rule for SUCRe in overcrowded scenarios is proposed in [5]. A retransmission from the k-th UE depends on the probability of it being the strongest contender for a pilot. The UE is able to compute this probability itself by knowing some parameters of the network, like the path-loss exponent and the number of inactive UEs in the cell. This soft SUCRe approach achieves a better RA performance 1 than original SUCRe protocol, without requiring additional coordination or centralized processing.
When a pilot collision occurs in SUCRe, the UEs that are closer to the BS, and therefore have the strongest channels, are favored in the collision resolution process. In the case of very crowded networks, this may considerably increase the probability of failed access attempts for the other UEs, leading to an unfair performance. Similar effects can be seen with SUCRe variants, like SUCR-IPA, SUCR-GBPA, and soft SUCRe, as a consequence of selecting the strongest UE in the collision resolution proccess. However, it is not evaluated in [2]- [5] how the distance of the UE to the BS can affect the RA performance.
The main contribution of this work is the access class barring with power control (ACBPC) protocol, which, based on a power control (PC) policy, enables the UEs to estimate the number of contenders for a pilot, without requiring additional overhead. Based on such estimation, an ACB factor is calculated in a decentralized manner, which corresponds to the probability of pilot retransmission in the next step. The main advantages of the proposed ACBPC protocol are: (i) improved fairness in terms of connectivity, since the achieved RA performance becomes independent of the UE distance to the BS; (ii) improved RA performance in the overcrowded scenario in comparison to SUCRe, since ACBPC has a better capability of resolving pilot collisions with many contenders; (iii) improved spectral efficiency in comparison with conventional ACB-based protocols in which the factor is sent by the BS, e.g., as in [3], since in ACBPC the UEs are able to obtain the ACB factor by themselves, without additional overhead, by leveraging the channel hardening effect due to the massive number of antennas at the BS; (iv) improved energy efficiency in the overcrowded scenario, since ACBPC achieves a fair RA performance with a reduced average energy consumption per UE. Numerical results demonstrate the effectiveness of ACBPC in very crowded scenarios, with as much as 11000 inactive UEs, since it obtains a much more uniform probability of collision resolution as a function of the distance to the BS. Besides, the ACBPC UEs consumes a lower average energy for RA purpose than UEs employing SUCRe or soft SUCRe protocol at any distance to the BS, while this energy saving can reach 88% at certain distances. In very crowded machine-type communications scenarios, |U i | ≫ T , but UEs become active with probability P a ≤ 1. Thus, |A i | < T holds, and therefore the BS can temporarily assign orthogonal pilots to the active UEs. By focusing on cell 0, and denoting K 0 = U 0 \A 0 as the set of inactive UEs, its cardinality is K 0 = |K 0 |. Such UEs share τ p orthogonal RA pilots ψ 1 . . . ψ τp ∈ C τp satisfying ||ψ t || 2 = τ p , t ∈ {1, 2, . . . , τ p }. The UEs wanting to become active randomly choose one of the available τ p RA pilots in each RA attempt; e.g. the kth UE selects pilot t and transmits it with power ρ k > 0. Therefore, if the set S t ⊂ K 0 contains the indices of the UEs that selected RA pilot t, then |S t | ∼ B K 0 , Pa τp [2].
The channel between the k-th UE and BS 0 is large-scale fading, consisting of path loss and shadowing, while small-scale fading h k ∼ CN (0, I M ). Moreover, it is reasonable to assume that large-scale fading β k is known, once it is possible to estimate it, for instance, in the SUCRe protocol initialization step [2].
Focusing on the RA stage, the four steps of SUCRe are: Step where where the effective noise is Step 2: BS transmits with power q, orthogonal precoded downlink (DL) signal V ∈ C M ×τp according to each pilot: The UEs receive ν k ∈ C τp is inter-cell interference, and η k ∼ CN (0, σ 2 I τp ) is noise. After correlating z k with ψ t , the UE calculates where η k ∼ CN (0, σ 2 ). Let α t = i∈St ρ i β i τ p + ω t be the sum of gains and interference as seen at the BS according to (2), then an asymptotically error free estimator for α t is [2]: ℜ(·) is the real part and Γ(·) is the complete Gamma function.
Step 3: SUCRe resolves pilot collisions in a distributed fashion, such that each pilot is retransmitted, ideally, by only one UE. Notice that each UE k ∈ S t knows its own average signal gain ρ k β k τ p and obtains an estimateα t,k for α t evaluating (6). Then, each UE applies locally the decision rule: A suitable value for the bias parameter ǫ k ∈ R in (7) is given in [2] based on ω, which is the average value of ω t .
Step 4: The BS allocates dedicated data pilots to the UEs if no RA collision remained.

III. PROPOSED RA PROTOCOL
A drawback of SUCRe is that it gives preference to the strongest UE when resolving a collision, which usually results in selecting those closer to the BS, in detriment of the edge UEs. As the number of inactive UEs grows, and collisions occur more often, it becomes difficult to the edge UEs to establish a connection with the network. Instead, in this work we propose an RA protocol that introduces fairness among UEs, in the sense that the UEs have basically the same success connection probability, regardless of their distances to the BS.
Since the kth UE has an estimate of its long-term fading coefficient, β k , it can adjust its pilot transmit power inversely proportional to β k , up to a maximum transmit power limit.
Therefore, the pilot transmit power of the kth UE is ρ pc k = min{ ρ β k , ρ max }, in which ρ is the average received power at the BS, and ρ max is a maximum transmit power constraint.
The signal received at the BS and its correlation with ψ t results in expressions similar to (1) and (2), respectively, but considering ρ pc k instead of the uniform power coefficients ρ k adopted in SUCRe. Indeed, the power control policy implies that the BS estimates only small-scale fading coefficients 2 for the UEs in S t when evaluating (2). In the second step, the precoded DL pilot signal sent by the BS is computed as in (3); then, the received signal at UE k is according to (4), upon which z k is obtained as in (5). Finally, the sum of gains and interference at the BS is and is estimated at the UEs as (6) with ρ pc k replacing ρ k . 2 When ρ β k > ρ max for a given UE, the small-scale fading vector of this UE in yt under our power control policy will be weighted by a factor lower than one, but the protocol proceeds in the same way. Since such condition occurs very rarely, it does not result in any significant performance loss.
The interference ω t can be partially canceled by subtracting its average ω fromα t,k . Notice that ω can be estimated since it has the same fixed value for all UEs [2]. We can thus obtain an estimate for |S t | fromα t,k under the proposed approach as Thereby, an ACB factor can be calculated as ζ k = |S t | −1 k , so that each UE retransmits its pilot in step 3 with probability ζ k . Note that the proposed solution does not require any additional control overhead for the UEs obtaining the ACB factor, in contrast to other ACBbased RA protocols [3]. Besides, ACBPC demands little additional computation compared to SUCRe. It is only required that the UEs take a decision with probability ζ k , which can be done by generating a random number ∈ [0, 1] and comparing it with ζ k .
It is simple to derive an upper bound for the probability of ACBPC protocol resolving a pilot collision, P res , with |S t | contenders. The obtained expression constitutes an upper bound since it assumes a perfect estimation for |S t |. The probability of pilot retransmission in step 3 of SUCRe is 1 |St| , and the collision is resolved if only one UE retransmits the tth pilot. Therefore, we have Given the representation of the exponential function as a limit, e x = lim n→∞ 1 + x n n , then lim |St|→∞ P res = e −1 . This implies that the probability of ACBPC resolving pilot collisions with so many contenders converges to 36.78%, differently than SUCRe in which this probability tends to 0.

IV. NUMERICAL RESULTS AND DISCUSSION
If a collision occurs and the protocol is not able to resolve it, the UE makes a new attempt after a random backoff as in [2]. In our setup, if the number of access attempts from a UE exceeds 10, a failure is declared. We compare the performance of the proposed ACBPC protocol with that of SUCRe [2] and/or soft SUCRe [5], considering different performance metrics. Our focus on these protocols, instead of SUCR-IPA and SUCR-GBPA, is because the latter ones require significant additional overhead for the BS transmitting the idle pilots indices to the UEs. This overhead is harmful to the system performance from both spectral and energy viewpoints. In contrast, SUCRe, soft SUCRe, and the proposed ACBPC protocol require the same level of knowledge at the UE, allowing a fair comparison. Moreover, P a = 0.1%, τ p = 10, and K 0 ∈ [1,28000]. The other parameters are as in [2]: d max = 250m, d min = 25m, d = 10 −3.53 , path loss exponent κ = 3.8, shadowing standard deviation σ shadow = 8 dB, and β k = d · d −κ · χ k , with d k being the distance and χ k the log-normal shadowing coefficient of the kth UE. The intercell interference is obtained considering τ p active UEs randomly positioned in each one of the 6 adjacent cells, and transmitting with the same average power than UEs in cell 0. In the SUCRe protocol, the transmit power is fixed and computed in the same way as in [2], i.e., ρ k = ρ SUCRe = σ 2 /(d · d −κ max ), ∀k. On the other hand, for the proposed ACBPC protocol, we have set ρ = σ 2 , and ρ max = ρ SUCRe , assuring that ACBPC UEs never transmit with more power than SUCRe UEs. Fig. 1 shows the average number of access attempts and the probability of failed attempts for the proposed ACBPC protocol and SUCRe. Intercell interference limits the system performance for low values of K 0 , but is not the most stringent factor in very crowded scenarios. One can note that ACBPC is outperformed by SUCRe for K 0 < 11000, while ACBPC presents a better performance for overcrowded scenarios where K 0 > 11000. Note that when K 0 > τ p /P a , there are on average more UEs trying to access the network than available pilots, and thus collisions are highly likely to occur. For example, while the UEs require on average 8.275 access attempts employing SUCRe (considering interference) for As the expected value of contending UEs depends on K 0 , an estimator can be conceived based on the method of moments. If employing SUCRe, the BS can evaluate the average number of idle pilots, which is also dependent on K 0 , allowing thus its estimation. In both cases, as K 0 changes very slowly with time, the estimation can be evaluated based on a very large number of observations.  This justifies the performance results in Fig. 1, since for low values of K 0 , the collisions occur more often with a number of contenders that SUCRe is more efficient to resolve. The opposite holds for high values of K 0 . Note that the results in Fig. 2.a are independent of K 0 , which just determines what values of |S t | are more common in the pilot collisions. Fig. 2.a also depicts the upper bound in (10), which almost equals the performance in the scenario without interference. Therefore, intercell interference has the most adverse effect for the |S t | estimation. For example, with |S t | = 1, the intercell interference can be seen by the BS as a second UE contending by that RA pilot, resulting in performance loss even in this case.
Notice that due to the channel hardening ||yt|| 2 M M →∞ −→ α t + σ 2 , but ω t does not converge to ω, since the last is averaged with respect to the adjacent cells UE locations and shadow fading realizations. Therefore, subtracting ω fromα t,k will not eliminate the intercell interference even with infinite number of BS antennas. Besides, further elaborated estimators for |S t | can be conceived, but this is outside the scope of this paper.
On the other hand, Fig. 2.b depicts the probability of a given UE winning a pilot collision Since the probability of winning a pilot collision decreases for the farther UEs under the SUCRe protocol in the overcrowded scenario, one can expect an increased average number of access attempts for these UEs, as well as an increased probability of failed attempts. This is shown in Fig. 3 only for the scenario with interference, since the performance curves without interference were very similar in this case. One can see that the very unfair performance of SUCRe can be replaced by a much more uniform experience when employing the proposed ACBPC protocol. An average number of about 7.73 access attempts can be assured for the UEs in any location within the cell employing ACBPC, as well as a constant probability of failed access attempt of about 0.75. In contrast, SUCRe provides a better performance for the UEs closer than ≈100m from the BS, but a very worse performance for the remaining UEs, corresponding to ≈ 80% of the cell area. Fig. 3 also investigates the RA performance when UEs have imperfect β estimates modeled as β ′ k = ϕβ k , in which ϕ ∼ N (1, σ 2 β ), with σ β = 0.2. It is shown that the performance of ACBPC is little sensitive to imperfect β estimates, while SUCRe performance is slightly improved, in a similar effect than the random powers discussed in [2]. Fig. 3 also depicts the soft SUCRe performance, i.e., the SUCRe with soft retransmission criterion of [5]. This latter provides a better performance for closer UEs in detriment of the farther ones, similarly to SUCRe. The distance, however, in which the UEs employing this protocol start to require a higher average number of access attempts than ACBPC UEs is increased to ≈ 160m, such that ≈ 49% of the UEs are closer than this distance.
Finally, Figure 4.a depicts the average transmit power of the UEs per attempt according to their distances to the BS, normalized by ρ SUCRe . It shows that a much lower power is transmitted on average with the power control strategy deployed by ACBPC. The soft SUCRe protocol of [5] employs the same transmit power as the SUCRe protocol, and, therefore, it is higher than the average ACBPC transmit power. On the other hand, Figure 4 estimates. In addition, an improved RA performance is achieved in the overcrowded scenario in comparison to SUCRe, due to the better ability of our proposed approach in resolving pilot collisions with a high number of contenders spending less energy, thanks to its higher connectivity efficiency. The proposed ACBPC scheme is promising and can be combined with SUCRe in a hybrid solution to cover a wide parameter range for crowded scenarios.


A Study of Password Security Factors among Bangladeshi Government Websites

The Government of Bangladesh is aggressively transforming its public service landscape by transforming public services into online services via a number of websites. The motivation is that this would be a catalyst for a transformative change in every aspect of citizen life. Some web services must be protected from any unauthorised usages and passwords remain the most widely used credential mechanism for this purpose. However, if passwords are not adopted properly, they can be a cause for security breach. That is why it is important to study different aspects of password security on different websites. In this paper, we present a study of password security among 36 different Bangladeshi government websites against six carefully chosen password security heuristics. This study is the first of its kind in this domain and offers interesting insights. For example, many websites have not adopted proper security measures with respect to security. There is no password construction guideline adopted by many websites, thus creating a barrier for users to select a strong password. Some of them allow supposedly weak passwords and still do not utilise a secure HTTPS channel to transmit information over the Internet.

I. INTRODUCTION
With almost a ubiquitous presence of the Internet, more and more services are provided online using web. A plethora of different web services have had a positive impact on almost every aspect of our human lives. Online services exhibit a number of additional advantages in comparison to the traditional mode of service delivery such as a global 24/7 access, cost savings, ease of use and flexibility, thus narrowing down the gap of accessibility hindrance [1].
Governments from all over the world are also offering an increasing amount of governmental public services via online, the so-called e-Government initiative. With the Digital Bangladesh initiative, the Government of Bangladesh has pledged to leverage ICTs (Information & Communication Technologies) to facilitate a transformative change in every aspect of the life of a Bangladeshi citizen [2]. Towards this goal, the Government of Bangladesh is offering an increasing number of online public service.
In recent times, different Bangladesh institutions and organisations are facing continuous cyber threats. The Bangladesh Bank Cyber Heist still remains the largest example, in terms of financial loss, of an online security breach for any organisation in the world [3]. Therefore, to counteract these security threats, we must guarantee the security of the offered public services. Indeed, many of these services handle sensitive information and hence, must ensure a restrictive access so that only authenticated and authorised users can access the correct personalised service. To enable this, every user must register at first and then login using an identifier (e.g. username, email address and so on) and a credential. There are a different forms of credentials utilised in online services, however, passwords remain the most widely used one. A recent study estimates that the number of passwords utilised for online services will be around 300 billion by 2020 [4]. Unfortunately, even with its ubiquitous utilisation, password remains one of the major sources of security breaches for online services [5]. That is why it is essential to study and understand different aspects of password security on different Bangladeshi government websites. Surprisingly, there is a pressing gap in this domain. In this paper, we report a study that aims to fill in this gap.
We have conducted a study analysing 36 Bangladeshi government websites and their offered services against six chosen heuristics: password construction guidelines, password recovery mechanism, utilisation of CAPTCHA, security questions, utilisation of HTTPS and password strength meter. Using these six heuristics we aim to gauge the security status and preparedness of Bangladeshi government agencies and suggest a set of recommendations for any weakness found.
Structure: The rest of the paper is structured as follows. Section II describes related work whereas Section III provides a brief background on password authentication along with a discussion of the chosen heuristics for the study. In Section IV, we explain our methodology. Section V presents the results of this study along with their implications and outlines a set of recommendations. Finally, we conclude in Section VI with a hint of future work.

II. RELATED WORK
In this section, we explore a few related researches involving different aspects of passwords and other Bangladesh-focused security studies. Password research has been a widely studied research domain for around three decades or so with a number of influential researches. For example, a review of different types of passwords, their security mechanisms, possible attack methods and weaknesses as well as the password reuse issue can be found in [6]- [9]. There have been a number of researches exploring the influence of culture between different password aspects, such as on the memorability, utilisation and management, and the citizens of different countries [10]- [12].
Despite passwords being a widely studied research domain in the field of security, the number of research papers in this domain targeting Bangladeshi citizens and web services are rare. Khan et. al presented a study on Bangladeshi people's knowledge and security awareness about different security practices on the Internet [13]. They took a survey of 1682 Bangladeshi online users and asked them about different security practices like how often they changed their passwords, whether they wrote down or shared their passwords with others and so on. The result was then compared with the users of developed countries and unsurprisingly, they found security knowledge gaps among Bangladeshi users. In a similar study, authors in [14] presented a comparative study of password construction and management strategies between the users of Bangladesh and developed countries. This study also reported that the most of the Bangladeshi users did not follow the general practices to make a password secure. Moniruzzaman et. al examined a number of vulnerabilities in different Bangladeshi websites [15] and found out that many Bangladeshi websites, mostly Bangladeshi government websites, were vulnerable against a number of attack vectors.
These research works explored website securities, password awareness and security practices. However, to the best of the authors knowledge, there is no study exploring the utilisation of different password-related security factors among the government websites of Bangladesh. Such study would be extremely useful to gauge the security status and preparedness of Bangladeshi government agencies. In this paper, we aim to fill in this gap.

III. PASSWORD AUTHENTICATION
To provide personalised online services, the identity of every user must be verified using an authentication mechanism, a process of determining someone's identity [16]. This is an essential mechanism in many real life scenarios when someone has to show an ID card to prove their identities to access a service, e.g. borrowing a book from a library. However, authentication becomes indispensable in online services as there is no physical way to prove someone's identity. There are different authentications mechanisms which can be grouped in three different categories [16]: something a user has (like a card or a key), something a user knows (like a secret phrase) and something the user is (bio-metrics such as a fingerprint).
A password is an authentication mechanism that falls under the "the something a user knows" category. It is essentially a shared secret between the user and a service provider relying on the premise that this secret is not shared/disclosed to any other party and this is by which a user can be determined to access personalised services from a web service. There are a number of widely used authentication mechanisms for online services and mobile devices using passwords, biometrics such as fingerprints [17], voice [18] and retina [19]. However, password still remains the mostly used and deployed authentication mechanism as other techniques are relatively expensive to implement and maintain.
The security of a password is of paramount importance.
If a password is not secure, a user may face a number of security breaches such as the respective account being hacked, data theft and so on [20]. To make a password secure, researchers have devised a number of techniques and guidelines. It has also been found that many users often write down their passwords in papers as they forget them frequently [21]. However, writing down a password is a bad habit as it may compromise the security of the system even if a strong secure password is used. Sharing passwords with friends and families is another bad habit found among general users [22] which a user should avoid doing. Users engage in such activities because of their of lack of knowledge on the importance of password security. Another important factor is how a password is transmitted from the web browser of a user to the service provider during the registration and login phases. Based on the above discussions, we have identified six crucial heuristics, presented below, which are important to assess different aspects of password security for any online service, including Bangladeshi government websites.

A. H1: Password Construction Guidelines
There are a number of ways by which a secure and strong password can be constructed. These mechanisms are often outlined in a series of of requirements and recommendations known as password guidelines [23]. Depending on the security requirements, different organisations utilise different password guidelines. For example, a password guideline could dictate the length of the chosen password or how different characters such as a small letter, capital letter, digits, or a special character can be mixed together to build a security password. The security of a password is often measured using entropy which implies the difficulty of breaking a password using different attack methods such as guessing, brute-force, dictionary attacks and so on [24]. Next, we explore different password constructions guidelines.
A password with at least a length of 8 characters with no composition (construction) requirement, is called Basic8 composition [25] and its entropy value is 18 bits. A password with length at least 16 characters with no composition requirement, is called Basic16 composition [25] which has an entropy of 30 bits. Another composition requirement titled Dictionary8 requires a password to of at least length 8 with no dictionary words allowed. Its entropy value is 24 bits. A composition technique with entropy 30 bits where the length requirement is at least 8 does not allow users to use dictionary words and is constructed using upper-case, lower-case, digits, and special characters. This composition is called Comprehensive8 which has a similar entropy of Basic16. A password with a higher entropy is considered more secure.
Displaying a password construction guideline on the website of the service providers during the registration phase (where a user chooses a password) can aid the users to choose a secure password and its enforcement ensures every password meets the minimum security requirements. Such a guideline also indicates the seriousness of the service provider with respect to the security.

B. H2: Password Recovery
Since users need to maintain a number of passwords for many different websites, it is not surprising that they often forget their passwords. In fact, forgetting password is a common issue. To remedy this situation, service providers must provide a password recovery option. There are a number of ways this recovery mechanism can be initiated, e.g. by sending a reset link to the registered email or phone number or via another secure channel.

C. H3: CAPTCHA
A CAPTCHA (Completely Automated Public Turing test to tell Computers and Humans Apart) is a security measure which is used to distinguish between a human and a computer program [26]. A CAPTCHA is designed in such a way that a person can pass the CAPTCHA test which requires to take decisions in a contoured or fuzzy environments. However, a computer program or script fails the test. CAPTCHA is integrated in the registration as well as password recovery phase of a web service to ensure that only valid users are registered to access their services, so as to guard against automated bots utilised by attackers [27]. A CAPTCHA can be of different types such as text, image, audio, video and puzzle, each with their security strengths [28].

D. H4: Security Question
To secure the recovery process, one of the widely used mechanisms is the option of one or more security questions and a user must answer the question(s) correctly before the password recovery option can be initiated. Such a question/answer mechanism can be used to create another layer of security to identify authentic users. Security questions and their answers are recorded during the registration phase and stored in the backend database. Later, when the user wants to recover the password, the chosen security question is asked again to match the answer, thereby cross-checking the authenticity of the user.

E. H5: HTTPS Channel
The service provider also has a crucial role to play for securing a password and other sensitive information while they are transmitted using a web protocol. HTTP (Hypertext Transfer Protocol) is a major web protocol used to transfer data, such as website contents or API calls, over the Internet between a web server and a client such as a browser, a mobile app or another web service. Unfortunately, HTTP is an insecure protocol [29] meaning that every information is transmitted over an HTTP channel in plain-texts. This enables an attacker to observe the network traffic and get hold of sensitive information (such as passwords) transmitted over HTTP. To address this problem, a secure web protocol called HTTPS (Hypertext Transfer Protocol Secure) has been devised. HTTPS is a secure extension of HTTP creating an encrypted channel using TLS/SSL on top of HTTP, thereby ensuring the confidentiality, integrity and authenticity of the web server as well as the contents transmitted between the web server and the client. Every web service should utilise the HTTPS channel to ensure that passwords and other sensitive information are never transmitted over an insecure (HTTP) channel.

F. Password Strength Meter
One of the main reasons behind password hacking is the use of a weak password. Because of the lack of knowledge on security, a user may not be aware that (s)he is choosing a weak password. If a visual feedback could be provided when a password is created (during the registration phase), it would help the user to construct a strong password. A password strength meter is a visual representation of the strength of newly created password [30] providing a visual cue, to the user, in real-time. This cue is provided using a combination of text and image where a password strength is categorised by weak, medium and strong texts and a supplementary image reflects this category in different colors. Figure 1 shows a sample of a password strength meter where a red color indicates that the given password is weak whereas green would refer it to be a strong password. It has been argued that a password strength meter can a great aid for the users [31] and that is why it has been included as one of our heuristics.  In the next step, we have shortlisted (denoted with selList in Algorithm 1) the govList by visiting each website individually one by one and checking if they have any registration and login features so that a user can create an account for getting services from the website. The motivation behind this step is that not all websites will require registration and login features and hence, they do not need to deal with passwords and can be excluded. This process is explained in line 4 and lines 14 to 18 in Algorithm 1. At the end of this step, we have managed to find 36 websites that meet our criteria. Among these 36 websites, the majority (30, around 83%) provide services whereas five (13.8%) provide information and one is a training website. The detailed information regarding these websites along with their URLs and purposes is presented in Table I. In the final step, we have visited these 36 websites one by one, created an account and investigated if each website satisfies the selected six heuristics as outlined in lines 5 to 12 in Algorithm 1. Consequently, we have marked the heuristic for that respective website with a 'Yes' (line 8 in Algorithm 1). Otherwise the heuristic has been tagged with a 'No' (line 10 in Algorithm 1) with some additional comments.

V. RESULTS & DISCUSSION
In this section, we present and analyse the findings of our study (Section V-A) along with a discussion and a set of recommendations (Section V-B).

A. Analysis
Now, we present an analysis of the findings of our study for each heuristic. Our findings for all heuristics have been summarised in Table I where the symbol " " has been used (for all heuristics except H1) to denote if a particular website satisfies a respective heuristic or the symbol " " has been used to denote the opposite (not satisfied) whereas PS implies that the password is provided by a website. We have counted the number of heuristics satisfied by each investigated website and the distribution of satisfied heuristics are presented in Figure  2 for H1 and Figure 3 for other heuristics.  (Figure 2). 18 websites do not provide any guidelines and allow a password of any length and strength to be created. On the remaining 5 websites, the password for a user is created by the system which is then supplied to the user. Three out of these five websites utilise an OTP (One Time Password) sent over another channel (e.g. email, mobile phone and so on) during the registration as well login phases instead of using a fixed password. This is an alternative mode of authentication, however, the user might face severe consequences when the user loses control of the registered phone number or email address. Among the 13 websites providing guidelines, they have adopted a wide variety of guidelines. We have grouped these guidelines in seven different categories as presented below, where PG stands for Password Guideline. Out of these guidelines, PG-6 is supposedly more secure if no dictionary word is used. PG-1 can be the least secure one as it allows a password of only four characters without any mixture of letters, numbers and special characters. Even PG-7 can be vulnerable since it allows any password length.
• PG-1: At least 4 characters • PG-2: At least 6 characters  The corresponding guideline has been used in the respective field for H1 column in Table I. The distribution of these guidelines among the 13 websites are presented in Figure 4. As per the figure, the mostly adopted guidelines is PG-4 requiring a password length of 8 characters adopted by 4 websites.
H2: Password recovery factor being a basic security mechanism, has been found in all 36 websites ( Figure 3). However, the interesting observation is the recovery channel utilised by different websites. For example, 24 websites (more than 66%) have adopted emails as their password recovery channel into which the password reset links are sent. Such links are valid for a specific amount of time and passwords must be reset within that validity period. Mobile phones have been adopted as the password recovery channel by 7 website where an OTP is sent to reset the password. The remaining 5 websites use both of these channels for password recovery.
H3: As reported in Table I and Figure 3, CAPTCHA input is mandatory during the registration process on 16 websites while the rest of the 20 websites do not employ any CAPTCHA. As explained earlier, CAPTCHA might guard against the creation of falsified accounts via automated computers programs. Therefore, it is highly recommended to employ CAPTCHA and the websites which do not utilise CAPTCHA are susceptible against such attacks.
H4: As per our investigation only 4 websites (Figure 3) have asked security questions during the registration phase. Examples of some of the questions asked are: • What is the name of your favourite book?
• What is the name of your first school? • What is your mother's maiden name?
• What was your dream job as a child?
• Who was your childhood hero?
Other 32 websites has no security question, thus, an attacker can falsely and easily initiate an account recovery process.
H5: It has been a surprise for us to observe that only 17 websites ( Figure 3) utilise an HTTPS channel, indicating that they are aware of the importance of a secure protocol. Unfortunately, the other 19 websites rely on the insecure HTTP channel and hence, they remain extremely insecure, and every information, including passwords, transmitted to these websites might be visible to attackers during the transmission.
H6: Another surprising finding is that only one website ( Figure  3) provides a password strength meter during the registration phase. Such a visualisation feature helps any user to create a strong and more secure password. That is why it is crucial that any website requiring a password entry should implement a password strength meter.

B. Recommendations
In this section, we present a number of recommendations to improve the security, with respect to passwords, of Bangladeshi government websites.
Recommendation-1: It is imperative that every governmental website adopts and enforces a secure password construction guideline. This will ensure that users do not opt in for easyto-guess insecure passwords. However, as we have found, there are a wide-range of password guidelines adopted by different governmental websites. To ensure a streamlined approach, we recommend to adopt (and show) a unified password construction guideline by (on) all governmental websites during the registration procedure. In addition to this, a password strength meter should be utilised to aid users selecting a secure, strong and compliant password.
Recommendation-2: Every governmental website must employ secure CAPTCHA mechanisms during the registration as well as password recovery phases. There are a wide-range of CAPTCHAs available varying in their types, security and usability. A unified policy for CAPTCHA should be devised and adopted for all governmental websites.
Recommendation-3: Each governmental website that deals with user registrations including password creation, storage and management must adopt an HTTPS-only policy to secure network traffic to and from their website.

Recommendation-4:
The secure storage of passwords is also very crucial. In an ideal scenario, every single password should never be transmitted via the network to the server. Instead, they should be hashed at the user side before their transmission (resp. storage) to (in) the server. This reduces the risk of password leakage in case a breach occurs at the respective server. Alternatively, it must be ensured that passwords are transmitted through an HTTPS channel and stored in encrypted form in the backend database.
Recommendation-5: Needing to create many accounts across different websites, a user will ultimately face the ill consequence of password fatigue [9], a pressing feeling to remember and manage passwords for so many websites. This forces a user to reuse one or two secure passwords for different websites, thereby increasing the chance of attacks [20]. An effective technique to offset password fatigue in the governmental setting is to adopt the notion of an Identity Federation. An identity federation is a trusted service model in which different service providers (known as SPs) are tied together under a formal agreement with a single identity provider (IdP) [33]. The IdP handles all identity activities such as identity creation, storage and management. Users need to register with that single IdP and they can access services from federated SPs using a single credential, thus significantly reducing the probability of password fatigue. Towards this aim, a proposal for a country-wide identity federation for Bangladesh was put forward by the authors in [34]. Sadly, it was difficult to adopt this approach previously as there was no central identity database in Bangladesh. However, with the current National ID database and its associated service such as Porichoy (https://porichoy.gov.bd/), Bangladesh currently has the infrastructure to deploy a nation-wide identify federation. We highly recommend to adopt this approach.

VI. CONCLUSION
In this paper, we have presented a study of password security among 36 different Bangladeshi government websites against six carefully-chosen password security heuristics. The main motivation is to understand the password security status of the chosen websites which in a way acts as the reflection of the password security awareness and preparedness among the corresponding government agencies. Our findings suggest that many websites have not adopted proper security measures. Many of them do not utilise any password construction guideline which can act as a barrier for users to select a strong password. Even the security guidelines employed by a few websites are not so secure. Similarly, many websites still do not leverage the HTTPS capability to securely transmit information, indicating a lack of knowledge as well as preparedness with respect to security. We hope that our study sheds some lights on some important password security factors and the respective authority takes a note of their lacking and act accordingly. However, it must be pointed out that passwords are just a single aspect of the overall security of any website. A rigorous evaluation of the remaining aspects must be carried out to fully understand the comprehensive security status and preparedness of different Bangladeshi government websites which we aim to do in future.