Suppose I have a Windows PC in a safe room, disconnected from the internet, with only 3 cables connecting to another room, to a mouse, monitor and keyboard.

The computer contains highly sensitive data. The HDMI monitor cable is no problem, but the mouse and keyboard cables are USB cables, and could be connected to some USB drive. I am specifically interested here in securing the USB cables. Please disregard other ways of stealing information, like taking photos of the screen etc. 

My question is: How can I make sure only some specific mouse and keyboard are allowed to be connected to the USB cables? 


For example, is there some kind of hardware I can put between the USB cable and the computer to make sure only some allowed device is connected to it? Security KVM Switches (Keyboard-Video-Monitor switches) are not good because in practice all of them seem to introduce some small delay (lag, or latency) when moving the mouse or typing. It really must feel as if you are directly connected (no lag whatsoever). Maybe there are some Arduino, BasicX, Parallax, Pololu, or Raspberry Pi projects out there to filter USB communication and let through only allowed devices, with no lag?
I know there is software to do that (e.g.: https://support.symantec.com/en_US/article.TECH175220.html) but since the user is using the computer he could disable it.


Buy a PS2 to USB adapter for keyboards+mice (important: both need to be in one usb port to make sure it's not a naive straight-through connector).  

They have logic and cost about $10 USD at time of writing.

Then buy USB to PS2 adapters for both mice and keyboard (separate adapters).  

They have no logic, just internal wiring to each connection and they cost less than $5 USD at time of writing. 

Put them altogether. Yes, it looks funky, but the devices will still work as-expected. Now, even if one of the user-reachable cables is spliced, they can't add new hardware other than generic mice and keyboards. 

Nice things about this:


cheap
simple
hardware-implemented
protects against unknown devices
OS-independent


UPDATE:
I manually verified, twice, that there is no continuity between USB's data-/data+ pins and the PS2 data/clk pins (or any other ps2 pins) on a two-in-one adapter. There is continuity on single-port adapters though, but that's not important as long as one of the adapters implements some kind of logic like the two-in-one does. Plugging in the empty adapter to a windows box should cause the "USB insertion ding"; otherwise it's a naive physical adapter.

The dual PS2-USB adapter I specifically tested was an "ez-pu21", available still on amazon.

UPDATE #2, 2 things:


there are usb keyboard attacks, so you need to lock down the OS properly to maintain security.
one can get inside bios with a keyboard, and i'm not sure how risky that is to exfiltration, or if all they can do is "break" the computer.


UPDATE#3:
After using the double-inline adapters for about 24 hours, I can say they work, but not quite 100%, maybe 99%.  When I was doing serious programming (typing) I noticed that keys held down for about 1/3rd of a second repeat. This is before my typematic repeat about 2/3rds a second after press, and it only repeats once; leading to stuff like "biig" instead of "big". I only noticed it a few times, late at night, but I wanted to mention it. I didn't even notice it until after hours of use, but if you were writing a novel, it might be frustrating. It could just be the cheap adapter i used, the really long cables i'm using or something else nobody will experience.

BONUS: (related but OT): I just realized these cheap usb switches don't connect the data pins, they are too cheap to switch all 4 wires, thus making a cheap "USB condom" for those who desire such a thing, thought i'd share. cheap condoms, how can you go wrong?
