There are a variety of USB-based microcontrollers available; evaluation kits can be had for $100 or less. The normal approach for hardware copy protection is to have a key receive a packet of data from the PC, munge the data, and send it back. The PC can then check whether it got what it expects. The amount of time and effort you spend on the dongle code will depend greatly upon your perceived threat model. Ideally, there would be some algorithm used in your code which (1) did not require a large bandwidth for inputs and outputs; (2) did not require an enormous amount of CPU power to compute; and (3) could not be readily inferred by examining inputs and outputs. A roll-playing game, for example, might put some aspects of a character's AI into the dongle. If the character is supposed to do something special if it enters the room with the golden fiddle, and the code for that behavior is only in the dongle and not in the PC-loaded software, even someone with full source code for the PC software wouldn't be able to "crack" the game to run properly without the dongle. If there aren't any "useful but obscure" algorithms that can be usefully put into the dongle, security will be much tougher. It wouldn't be hard to write a dongle that takes 8 bytes, encrypts them with some secret DES key, and sends them back, but someone who reverse-engineered the PC-side code could then imitate out the dongle. Using a public-key system like RSA would be better, but even if someone couldn't imitate the dongle the code that requires it could likely be bypassed.
