How immune is this solution to VID / PID spoofing? I've thought about this topic before and arrived at the idea that USB devices ought to be treated kind of like user accounts, where I can control what drivers / data / devices they have access to.
Would it also not be possible to measure power draw upon the device and with that, add another metric to device profiling. So if you have say a keyboard that uses 200ma power and then suddenly a device that has the same ID's is plugged in and uses 500ma of power, that would trigger a flag.
The real solution needs to be some sort of standardized auth system, where devices are identified by a public key rather than a static serial number. In the absence of that though, I think whitelisting serial numbers is the next best thing. It'll slow down attacks at least, and open the door for future improvements to the system.