We are designing a computer based test system where the examinees use their own computers to write their answers. The examinees' computers are booted to a custom Linux OS from USB drives provided by the examiner.
The USB drives that are used to boot the examinees' computers all contain exactly the same OS image.
The exam itself is provided by a central server and the answers are transferred back to the central server as they are being written. All the involved computers are in a closed LAN.
The system must support resuming the exam from the latest state transferred to the server in case of a hardware failure. The USB drive used as a permanent storage can potentially fail, as can the examinee's laptop computer.
The identities of the examinees are verified by trusted people at some point at the event (before, during, or after the examinees take the exam). The identity verification should cause minimal disruption for the examinees and minimal work for the trusted people. There can be up to a couple of hundred people taking the exam in the same space with approximately one trusted person per every 20 examinees.
Our current design is to generate a strong token on the examinee's computer when the examinee starts the exam. The token would be calculated using the SSN provided by the examinee, and some hardware UUIDs (CPU, USB drive). This token would be stored on the USB drive. When the examinee finishes the exam, she would pass the drive to a trusted person. The trusted person would then, using a dedicated computer, verify the identity of the examinee and the token stored on the drive against the token stored on the central server.
The pros of this design are that it is easy for a group of examinees to start the exam, and the verification is a read-only activity at the end of the exam. This design has at least one weakness: in case the hardware used for the tokens of two or more examinees breaks down simultaneously, it's no longer possible to verify who had hold of which device. For example, a power surge could cause multiple laptops and drives to break down at the same exact moment.
What other attack vectors come to mind and how could they be mitigated? Any better alternative designs?