To normalise the level you can use an ALC (auto level control) or AGC (auto gain control); this can be implemented in either hardware or software. The hardware version will allow you to get better performance as there will be less quantisation noise. The software version is obviously cheaper.
As far as hardware goes, the SSM2165/2166/2167 are simple to use (I've used the 2166) and have OK performance (good enough for speech). There are of course other ICs available too; they may also be called microphone conditioners.
I guess cross-correlation should work; it will need a lot of storage (for the data you're comparing to). You can also use autoregression (e.g. Burg AR) to parameterise the sample into frequency representation (filter model) which uses less data; I can't comment on how it's performance compares with x-corelation though.
Maybe if you normalise the frequencies the system will be less speaker-dependant (again, I've no idea). I would be interested in hearing what you come up with though.