EXAM
LOCKER
Secure Examination Paper Distribution Platform
Technical Architecture & Implementation Guide
No single person can release a sealed paper alone.
(Fraud Detection & Intelligence Wing)
Exam Locker, in simple terms.
Exam Locker is a secure digital system for sending university examination papers to exam centres without printing them early, transporting them in trucks, or storing them in strong rooms.
Think of it like a bank locker for question papers. The final paper is first given a special identity for each exam centre, then encrypted - turned into unreadable locked data - before it is uploaded. Even if someone steals the server or downloads the file early, they cannot read the questions.
The digital key needed to open each paper is divided among five trusted university custodians. Any three must approve the release, so no single administrator can unlock or leak a sealed paper alone. The paper becomes readable only shortly before the examination, and only on the authorised computer at the correct centre.
Each centre receives its own marked version. If a printed paper is photographed or leaked, its visible and hidden markings can help identify where it came from.
Every important action - uploading, approval, unlocking, printing, failed login attempts and closing the session - is recorded in a tamper-evident audit history. This helps investigators understand exactly who did what and when.
In simple terms, Exam Locker replaces printing presses, transport trunks and strong rooms with encryption, shared authority, controlled printing and a complete digital record.
The entire system in one page.
What is Exam Locker?
One key is not enough. The locker opens only during the permitted time window, and every opening is recorded. The difference is that the “locker” contains encrypted data, so stealing the server does not reveal the paper.
Explained in plain English for any non-technical reader.
Six ways an examination paper can be compromised.
Three compromised custodian credentials or devices could satisfy the threshold. Compensating controls: independent reporting lines, device-bound credentials, approval-pattern anomaly detection, ceremony logging, rapid revocation and mandatory post-event review.
The complete threat surface.
| # | Leak vector | Typical pattern | University Edition response |
|---|---|---|---|
| V0 | Sealing-stage insider / compromised workstation | Readable paper is copied before encryption or the sealing workstation is compromised | Outside the current cryptographic boundary. University controls apply before sealing; a controlled-authoring module is on the roadmap. |
| V1 | Printing press insider | Paper photographed during bulk printing | Central printing is eliminated. |
| V2 | Transport / logistics | Sealed trunks opened and resealed | Papers never travel physically. |
| V3 | Strong-room custody | Locker or treasury access collusion | No physical custody phase exists. |
| V4 | Centre insider | Paper opened or photographed early | Scheduled release, dual control and centre watermarking. |
| V5 | Digital compromise | Server breach or administrator abuse | Client-side encryption, separated approvals and audit chain. |
| V6 | Quorum compromise | Three custodian credentials or devices are compromised or collude | Independent reporting lines, device attestation, approval-pattern alerts, rapid revocation and evidence review. |
Exam Locker therefore separates creation, approval, release and centre access. One compromised person is not enough to expose a paper.
Exam Locker protects the final approved paper from the moment the Sealing Officer encrypts it. From that point onward, the platform removes printing-press, transport and strong-room exposure.
Drafting, moderation and committee circulation are outside this version's cryptographic boundary. Universities must control that stage through confidentiality policy, restricted access and documented approval. A controlled-authoring module may extend scope later.
What changes for a university.
Five custodians. Three required.
Primary custodian. Holds one encrypted share and authorises the examination release ceremony.
Primary custodian. Holds an independent share on a registered credential.
Primary custodian. Holds an independent share and witnesses release.
Pre-provisioned alternate custodian with a distinct share created at sealing.
Pre-provisioned alternate custodian with a distinct share created at sealing.
Operations can run the system. They cannot read the paper.
Creates each centre-specific edition, encrypts it locally and never acts as a release custodian.
Authenticates the assigned centre and conducts controlled printing. Does not hold a paper-key share.
Receives read-only custody records and verification exports for internal inquiry, police or appointed review.
Stores ciphertext and encrypted share capsules. It holds no custodian private key and cannot reconstruct any edition DEK.
Managing users, centres or schedules never grants the ability to read an examination paper.
Nothing becomes readable until the last possible moment.
T-7 days
T-5m
No one releases a paper alone.
The server routes encrypted capsules but owns no custodian private credential.
An alternate owns a distinct share created before sealing. No share is copied on exam day.
Fewer than three available custodians causes a safe delay; the threshold never drops.
How the key is split.
A fresh 256-bit DEK is generated for every centre-specific edition. Each edition DEK is split into five shares. One 3-of-5 quorum ceremony per exam session authorises dispatch of the precomputed encrypted capsules for all authorised editions in that session - not one ceremony per centre.
A unique DEK is generated for every centre-specific edition. A centre that reconstructs its own DEK cannot decrypt another centre's bundle.
For 45 centres, sealing creates 45 DEKs and 225 encrypted share capsules. Custodians approve once per exam session; the approval authorises dispatch of the precomputed capsules for all listed editions.
This preserves operational practicality without weakening centre isolation or forensic attribution.
A paper that identifies where it came from.
2. The examination duration is three hours.
3. Use the supplied answer booklet.
Centre code and session information appear on every page, discouraging resale and anonymous circulation.
Subtle, redundant page variations encode the centre identity and survive ordinary photographs and recompression after testing.
Physical copy numbers support reconciliation with candidate counts and surplus destruction.
A complete record of every action.
payload_sha256, previous_hash, signature }
Changing or deleting a historical event breaks the chain from that point onward. Regular external digest copies make silent history rewriting detectable.
Successful and failed actions are recorded in one ordered custody history.
Cryptographic links expose alteration, deletion or event reordering.
A verification package can be supplied to the university, police or an appointed inquiry.
What happens when something goes wrong.
Encrypted bundles are pre-delivered. Only the signed, short-lived release response requires live connectivity.
The session pauses safely and resumes under the same authorised centre identity after power returns.
No quorum release occurs. Replacement editions are sealed under fresh DEKs and new shares.
A pre-authorised backup printer may be selected. The change is observed, approved and recorded.
Any pre-provisioned alternate may join. Fewer than three available custodians causes a safe delay; no new share is issued.
The client rejects requests outside the window, expired messages, reused nonces or a centre/session mismatch and raises an alert.
From local reconstruction to completed printing, the signed client is the security boundary. Screen capture, memory extraction and modified-client resistance are endpoint controls and must be tested explicitly.
One live view of every examination centre.
Sign-in, printer and bundle status.
Who has approved and when.
Expected versus produced copies.
Early attempts, mismatches and failures.
A deployable university platform.
It is deployable on standard cloud or university infrastructure, while preserving separation of duties, client-side encryption and evidence-grade logging.
The records that make the system real.
boardsUniversity tenant, governance and retention settings.
examsSchedule, session, release window and status.
papersApproved paper identity, version and sealing state.
paper_editionsCentre-specific ciphertext, edition ID and isolated DEK metadata.
manifestsSHA-256 hashes, sizes, nonce, algorithm and object references.
centersAuthorised locations, registered clients and printer policy.
center_staffSuperintendent, Observer and controlled-session assignments.
custodiansFive named share holders, credential state and reporting line.
share_capsulesFive encrypted Shamir-share capsules per centre edition.
Every ceremony becomes verifiable evidence.
approval_ceremoniesOne session-level quorum ceremony and signed approvals.
release_messagesSigned, expiring, nonce-bound, one-time release responses.
unlock_sessionsCentre client, edition, staff, timestamps and consumption state.
print_jobsPrinter identity, copies requested, produced and reconciled.
attestationsClosure, surplus destruction and observer confirmation.
custody_eventsAppend-only hash-chained event chronology.
anchorsExternal digest witnesses that make silent history rewriting detectable.
alertsReplay, early access, quorum anomalies, mismatches and failures.
audit_exportsEvidence bundle, verification result and recipient record.
The anchors table stores periodic chain-head digests, witness identifiers, timestamps and receipts. The audit_exports table records the exact evidence package and verification result supplied to an authorised reviewer.
The practical security baseline.
AES-256-GCM is the mandatory paper-encryption algorithm for this final edition. A fresh random 256-bit DEK and unique 96-bit nonce are generated for every centre-specific edition. Algorithm agility may be designed internally, but the tender baseline is not written as “either/or.”
Each edition DEK is split with Shamir Secret Sharing, threshold 3-of-5. Each share is encrypted to one named custodian public key. The platform stores encrypted capsules only.
Every release response is digitally signed and bound to exam_id, paper_id, edition_id, centre_id, session_id, release_window, nonce and expiry. The centre client records one-time consumption and rejects replay.
A signed Electron/Tauri or native kiosk client is the security-bearing endpoint. A browser prototype may validate workflow, but is not presented as equivalent security.
Persistent OS spooling is disabled where supported. Temporary material uses an encrypted volume or memory-backed storage, followed by verified cleanup and printer-cache handling.
Custodian credentials are device-bound or held in a university-controlled secure credential store. Recovery, revocation and alternate activation follow the dedicated key-custody page.
Why not simply use CBT?
CBT requires devices, reliable power and connectivity, accessibility arrangements, secure test-delivery software and operational change at every seat. Many descriptive, diagrammatic, open-book or institution-specific examinations still require paper.
It preserves the familiar paper examination while eliminating bulk pre-printing, physical transport and strong-room custody. Universities can adopt it without redesigning the examination itself.
Compliance must be earned.
CERT-In security audit
Commission independent application, infrastructure and source-code assessment through an appropriately empanelled information-security auditing organisation before production use.
STQC assurance path
Evaluate independent software testing, security assessment and product-certification options appropriate to the deployment and procurement context.
MeitY-aligned controls
Map hosting, identity, logging, incident response, data retention and government-cloud requirements where applicable to the institution or funding authority.
Public Examinations Act, 2024
Assess legal applicability with counsel. The Act addresses unfair means in defined public examinations; a university must determine whether its examination and authority fall within the statutory definitions.
The pilot should produce a threat model, secure-development evidence, independent test reports, incident procedures, retention policy and an auditable operating manual.
Pilot. Prove. Audit. Scale.
Map roles, provision five custodians, register centre clients, define recovery and configure the examination session.
Run cancellation, missing-custodian, network failure, printer failure, replay and incident-response exercises.
Conduct the live examination, export evidence, measure watermark recovery and document every exception.
Proposed next step
Authorise a university discovery and pilot-design workshop to define the first examination, participating centres, named custodians, success metrics, implementation responsibilities and commercial proposal.
A university-ready security model.
The platform holds ciphertext and encrypted capsules, not examination content.
Every centre-specific edition uses a fresh DEK. One centre cannot open another centre's bundle.
A fixed 3-of-5 quorum is required; alternate custodians are pre-provisioned.
Move from dossier to pilot.
Approve the pilot-design workshop and select the first university examination for controlled implementation.