## 4 Experimental Results
### Security Analysis
#### 4.5.2 Resisting Other Attacks  
In this section, we will discuss brute force attack, cross-matching attack and guessing mapped binary code attack. (1) Brute force attack: In this attack scenario, an attacker directly tries to guess a bio-key. It is assumed that no a priori information about the bio-key is public to the attacker. To obtain the corrected bio-key, the attacker has no choice but to guess the bio-key in brute forcing. If the length \(l\) of bio-keys is known to the attacker, it will take \(2^{l}\) trials to obtain the corrected bio-key when the bio-keys are random and dissimilar. For instance, the attacker conducts \(2^{1024}\) attempts when the length \(l=1024\). Therefore, it is difficult to guess the bio-key by using an electronic computer in this situation. It can be noted that the randomness of bio-keys is important against the brute force attack. In our proposed approach, the bio-key for each user is derived from random binary code. Further, the randomness of bio-keys has been passed in Section 4.4.1. Therefore, bio-keys of inter-users are random and independent of each other, and it is impractical to guess the bio-key. (2) Cross-matching attack: In this attack scenario, we assume that the attacker can obtain a bio-key of a user, which can be used to perform cross-matching across multiple biometric databases. In our proposed scheme, to generate multiple discriminative bio-keys for the same user, we only modify permutation seed to produce random PVs in the enrollment stage, which can be deployed to multiple databases. Hence, the generated bio-keys of intra-users are also random and dissimilar for each other. The compromised bio-key cannot be linked to other biometric systems. In addition, we can easily regenerate  
Figure 8: The distributions of Hamming Distance between the imposter and the genuine, applied on (**a**) ORL dataset at \(l=512\); (**b**) Extended YaleB at \(l=512\); (**c**) CMU-PIE at \(l=512\). the PV to obtain a new bio-key by setting different random permutation seeds in the compromised system. In other words, our bio-key generation method has revocability that ensures the distinguishability and renewability of the bio-keys for intra-user, which has been analyzed in Section 4.4.2. Hence, our proposed approach can effectively resist cross-matching attack. (3) Guessing mapped binary code attack: In our bio-key reconstruction process, the bio-key is generated from mapped binary code. It is assumed that PV and AD stored in the database are known to an attacker. Meanwhile, it is tested if an attacker can correctly guess the mapped binary code. Based on the above assumption, the bio-key can be restored by utilizing the guessed binary code, PV, and AD of the user through our scheme. To analyze the effectiveness of our proposed approach against the attack, we measure the degree of freedom (\(N\)) (i.e., uncertainty) of the binary code from one sample of a user to an inter-sample of other users. Firstly, the binary code is generated from the sample of a user, and other binary codes are generated from inter-samples of other users. The normalized Hamming distances are calculated from the generated binary codes on ORL, Extended YaleB, and CMU-PIE datasets. Then, we compute the mean (\(\mu\)) and the standard deviation (\(\sigma\)) from the normalized Hamming distances, respectively. Next, the degrees of freedom \(N\) of the mapped binary code for the user in the three datasets are obtained as (\(N=\frac{\mu(1-\mu)}{\sigma^{2}}\)). Moreover, our ECC coding can correct approximately 10 percent of bit error. If \(N=512\) and \(C=0.1\times N\approx 51\), the attacker actually has \(2^{N-C}=2^{461}\) brute force (\(BF\)) trials. Finally, we can compute a conservative theoretical bound \(BF\) by using the bound formula, it can be defined as:  
\[BF=2^{N-C} \tag{12}\]  
where \(N\) is the degree of freedom, \(C\) is the error-correction bits, and \(BF\) is the brute force trials.