Physical encryption key system

A method, comprising:

• associating information to be secured by encryption with:
• a computing device,
• a currently logged on user of the computing device,
• a current computing domain of the user,
• a removable storage device currently coupled to the computing device, and
• an encryption key datum;
• creating an isolated storage space on the removable storage device;
• loading the encryption key datum into the isolated storage space;
• and
• removing the encryption key from the computing device,
• wherein the information is capable of being encrypted by the encryption key datum, and
• wherein decrypting the information using the encryption key datum requires the user to logon to the identical computing device in the identical computing domain and requires the identical removable storage device to be coupled with the computing device.

A system, comprising:

• means for associating access criteria with information to be encrypted;
• means for exclusively and irrevocably binding an encryption key to a removable drive of a computing device, wherein the encryption key is capable of securing and accessing the information;
• means for encrypting the information using the encryption key;
• means for requiring the access criteria to be fulfilled in order to decrypt the information using the encryption key;
• and
• means for requiring the removable drive to be coupled with the computing device in order to decrypt the information.

A method, comprising:

• binding an encryption key to a physical key using a computing device, a domain, and a computing program;
• and
• limiting access to the encryption key to an owner of the physical key, on condition that:
• the physical key is coupled to the computing device;
• the owner submits proper credentials of the owner;
• and
• the owner is using the computing device, domain, and computing program on which the encryption key was bound to the physical key.

A security engine, comprising:

• an encryption engine for generating an encryption key and for encrypting or decrypting information using the encryption key;
• an isolated storage manager to create an isolated storage space on a physical key that is capable of communicatively coupling and decoupling with the security engine, wherein the isolated storage manager loads the encryption key into the isolated storage space;
• and
• an access criteria engine to enforce conditions for accessing the encryption key, wherein one of the conditions is that the physical key on which the encryption key was first loaded is currently coupled with the security engine or coupled with a computing device hosting the security engine.

A medium readable by a computing device, including instructions that when executed cause the computing device to:

• generate an encryption key for encrypting or decrypting information;
• create an isolated storage space on a physical key that is capable of communicatively coupling and decoupling with the computing device;
• loads the encryption key into the isolated storage space;
• and
• control access to the encryption key, including denying access to the encryption key if the physical key is not coupled with the computing device.