Are there any laptops which feature hardware security modules to prevent password brute forcing, such as in iPhone's secure enclave

Question

Both iPhones and Googles Pixel 2 phone feature security hardware chips that essentially prevent brute forcing of the passcode by having it be handled by a dedicated hardware security module. To my knowledge this also prevents the device from being compromised even when the phone is simply locked and not turned off, because the ram encrypted as well, and all encryption is handled by the dedicated chip.

Is there any laptops which feature security like this? I do realize that both Apple devices and Google devices are running operating systems made by the company which made the device, and I see how that could pose issues when implementing such features in a laptop designed to take different operating systems.

I've always taken advantage of full disk encryption on my computers, but I know that these days it is rather easy to use various software to bypass the lockscreens of the computer. Typically the only way to ensure disk encryption does its job is to make sure your computer is off whenever it is fully compromised. However the aforementioned phone hardware security features seem to solve this issue with the dedicated chip.

Answer 1

Yes, most laptop CPUs nowadays supports a built in CPU mode for a secure enclave, for example Intel SGX and AMD TrustZone. They effectively implements secure enclave, by preventing code running in the regular mode from inspecting or controlling the code running in the trusted execution mode. In the case of Intel, the secure enclave also runs x86 code, while AMD embeds an ARM TrustZone co-processor that only runs the secure enclave program.

Answer 2

There are a few options and ways you can go about doing this. Depends on what level you're looking to set the protection.

You're speaking of hardware but have you considered cloud approaches? Google Drive has become a lot more secure and adding AODocs is becoming an option of choice for businesses. You can also consider Google Authenticator app and lock most elements off that way through double verification.

If you speak French or use Google translate you can also check out these tips for more standard hardware approaches. But in a nutshell it comes down to the following elements:

1. Account lockout threshold, which sets the maximum number of invalid login attempts before the lockout occurs.
2. Account lockout duration, which sets the time in minutes for which a lockout will remain in force. If you set this value to zero, the lock will remain until reset by an administrator.
3. Account lockout window. This security policy is responsible for setting the total length of time which must pass before the count of failed login attempts is reset to zero

Lastly, with Windows 10, this article from Microsoft on why PIN is better than a password might be a useful read.

I hope this was useful.

Answer 3

Windows Hello in Windows 10 enables users to use a PIN instead of a password when a laptop has a Trusted Platform Module built in. Pretty much all modern hardware has TPM chips now. The TPM chip itself does the PIN verification and has built-in brute-forcing protection (anti-hammering in TPM terminology). More info here:

https://docs.microsoft.com/en-us/windows/access-protection/hello-for-business/hello-why-pin-is-better-than-password