connected-device-lib/src/com/android/car/connecteddevice/storage/ConnectedDeviceStorage.java - platform/packages/apps/Car/libs - Git at Google

 /*
  * Copyright (C) 2019 The Android Open Source Project
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
  * You may obtain a copy of the License at
  *
  *      http://www.apache.org/licenses/LICENSE-2.0
  *
  * Unless required by applicable law or agreed to in writing, software
  * distributed under the License is distributed on an "AS IS" BASIS,
  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */

 package com.android.car.connecteddevice.storage;

 import static com.android.car.connecteddevice.util.SafeLog.logd;
 import static com.android.car.connecteddevice.util.SafeLog.loge;
 import static com.android.car.connecteddevice.util.SafeLog.logw;

 import android.annotation.NonNull;
 import android.annotation.Nullable;
 import android.app.ActivityManager;
 import android.content.Context;
 import android.content.SharedPreferences;
 import android.security.keystore.KeyGenParameterSpec;
 import android.security.keystore.KeyProperties;
 import android.util.Base64;

 import androidx.room.Room;

 import com.android.car.connecteddevice.R;
 import com.android.car.connecteddevice.model.AssociatedDevice;
 import com.android.internal.annotations.VisibleForTesting;

 import java.io.IOException;
 import java.security.InvalidAlgorithmParameterException;
 import java.security.InvalidKeyException;
 import java.security.InvalidParameterException;
 import java.security.Key;
 import java.security.KeyStore;
 import java.security.KeyStoreException;
 import java.security.NoSuchAlgorithmException;
 import java.security.NoSuchProviderException;
 import java.security.UnrecoverableKeyException;
 import java.security.cert.CertificateException;
 import java.util.ArrayList;
 import java.util.List;
 import java.util.UUID;

 import javax.crypto.BadPaddingException;
 import javax.crypto.Cipher;
 import javax.crypto.IllegalBlockSizeException;
 import javax.crypto.KeyGenerator;
 import javax.crypto.Mac;
 import javax.crypto.NoSuchPaddingException;
 import javax.crypto.spec.GCMParameterSpec;
 import javax.crypto.spec.SecretKeySpec;

 /** Storage for connected devices in a car. */
 public class ConnectedDeviceStorage {
     private static final String TAG = "CompanionStorage";

     private static final String UNIQUE_ID_KEY = "CTABM_unique_id";
     private static final String BT_NAME_KEY = "CTABM_bt_name";
     private static final String KEY_ALIAS = "Ukey2Key";
     private static final String CIPHER_TRANSFORMATION = "AES/GCM/NoPadding";
     private static final String KEYSTORE_PROVIDER = "AndroidKeyStore";
     private static final String DATABASE_NAME = "connected-device-database";
     private static final String IV_SPEC_SEPARATOR = ";";

     private static final String CHALLENGE_HASHING_ALGORITHM = "HmacSHA256";
     // This delimiter separates deviceId and deviceInfo, so it has to differ from the
     // TrustedDeviceInfo delimiter. Once new API can be added, deviceId will be added to
     // TrustedDeviceInfo and this delimiter will be removed.

     // The length of the authentication tag for a cipher in GCM mode. The GCM specification states
     // that this length can only have the values {128, 120, 112, 104, 96}. Using the highest
     // possible value.
     private static final int GCM_AUTHENTICATION_TAG_LENGTH = 128;

     @VisibleForTesting
     static final int CHALLENGE_SECRET_BYTES = 32;

     private final Context mContext;

     private SharedPreferences mSharedPreferences;

     private UUID mUniqueId;

     private AssociatedDeviceDao mAssociatedDeviceDatabase;

     private AssociatedDeviceCallback mAssociatedDeviceCallback;

     public ConnectedDeviceStorage(@NonNull Context context) {
         mContext = context;
         mAssociatedDeviceDatabase = Room.databaseBuilder(context, ConnectedDeviceDatabase.class,
                 DATABASE_NAME)
                 .fallbackToDestructiveMigration()
                 .build()
                 .associatedDeviceDao();
     }

     /**
      * Set a callback for associated device updates.
      *
      * @param callback {@link AssociatedDeviceCallback} to set.
      */
     public void setAssociatedDeviceCallback(
             @NonNull AssociatedDeviceCallback callback) {
         mAssociatedDeviceCallback = callback;
     }

     /** Clear the callback for association device callback updates. */
     public void clearAssociationDeviceCallback() {
         mAssociatedDeviceCallback = null;
     }

     /**
      * Get communication encryption key for the given device.
      *
      * @param deviceId id of trusted device
      * @return encryption key, null if device id is not recognized
      */
     @Nullable
     public byte[] getEncryptionKey(@NonNull String deviceId) {
         AssociatedDeviceKeyEntity entity =
                 mAssociatedDeviceDatabase.getAssociatedDeviceKey(deviceId);
         if (entity == null) {
             logd(TAG, "Encryption key not found!");
             return null;
         }
         String[] values = entity.encryptedKey.split(IV_SPEC_SEPARATOR, -1);

         if (values.length != 2) {
             logd(TAG, "Stored encryption key had the wrong length.");
             return null;
         }

         byte[] encryptedKey = Base64.decode(values[0], Base64.DEFAULT);
         byte[] ivSpec = Base64.decode(values[1], Base64.DEFAULT);
         return decryptWithKeyStore(KEY_ALIAS, encryptedKey, ivSpec);
     }

     /**
      * Save encryption key for the given device.
      *
      * @param deviceId id of the device
      * @param encryptionKey encryption key
      */
     public void saveEncryptionKey(@NonNull String deviceId, @NonNull byte[] encryptionKey) {
         String encryptedKey = encryptWithKeyStore(KEY_ALIAS, encryptionKey);
         AssociatedDeviceKeyEntity entity = new AssociatedDeviceKeyEntity(deviceId, encryptedKey);
         mAssociatedDeviceDatabase.addOrReplaceAssociatedDeviceKey(entity);
         logd(TAG, "Successfully wrote encryption key.");
     }

     /**
      * Save challenge secret for the given device.
      *
      * @param deviceId id of the device
      * @param secret   Secret associated with this device. Note: must be
      *                 {@value CHALLENGE_SECRET_BYTES} bytes in length or an
      *                 {@link InvalidParameterException} will be thrown.
      */
     public void saveChallengeSecret(@NonNull String deviceId, @NonNull byte[] secret) {
         if (secret.length != CHALLENGE_SECRET_BYTES) {
             throw new InvalidParameterException("Secrets must be " + CHALLENGE_SECRET_BYTES
                     + " bytes in length.");
         }

         String encryptedKey = encryptWithKeyStore(KEY_ALIAS, secret);
         AssociatedDeviceChallengeSecretEntity entity = new AssociatedDeviceChallengeSecretEntity(
                 deviceId, encryptedKey);
         mAssociatedDeviceDatabase.addOrReplaceAssociatedDeviceChallengeSecret(entity);
         logd(TAG, "Successfully wrote challenge secret.");
     }

     /** Get the challenge secret associated with a device. */
     public byte[] getChallengeSecret(@NonNull String deviceId) {
         AssociatedDeviceChallengeSecretEntity entity =
                 mAssociatedDeviceDatabase.getAssociatedDeviceChallengeSecret(deviceId);
         if (entity == null) {
             logd(TAG, "Challenge secret not found!");
             return null;
         }
         String[] values = entity.encryptedChallengeSecret.split(IV_SPEC_SEPARATOR, -1);

         if (values.length != 2) {
             logd(TAG, "Stored encryption key had the wrong length.");
             return null;
         }

         byte[] encryptedSecret = Base64.decode(values[0], Base64.DEFAULT);
         byte[] ivSpec = Base64.decode(values[1], Base64.DEFAULT);
         return decryptWithKeyStore(KEY_ALIAS, encryptedSecret, ivSpec);
     }

     /**
      * Hash provided value with device's challenge secret and return result. Returns {@code null} if
      * unsuccessful.
      */
     @Nullable
     public byte[] hashWithChallengeSecret(@NonNull String deviceId, @NonNull byte[] value) {
         byte[] challengeSecret = getChallengeSecret(deviceId);
         if (challengeSecret == null) {
             loge(TAG, "Unable to find challenge secret for device " + deviceId + ".");
             return null;
         }

         Mac mac;
         try {
             mac = Mac.getInstance(CHALLENGE_HASHING_ALGORITHM);
         } catch (NoSuchAlgorithmException e) {
             loge(TAG, "Unable to find hashing algorithm " + CHALLENGE_HASHING_ALGORITHM + ".", e);
             return null;
         }

         SecretKeySpec keySpec = new SecretKeySpec(challengeSecret, CHALLENGE_HASHING_ALGORITHM);
         try {
             mac.init(keySpec);
         } catch (InvalidKeyException e) {
             loge(TAG, "Exception while initializing HMAC.", e);
             return null;
         }

         return mac.doFinal(value);
     }

     /**
      * Encrypt value with designated key
      *
      * <p>The encrypted value is of the form:
      *
      * <p>key + IV_SPEC_SEPARATOR + ivSpec
      *
      * <p>The {@code ivSpec} is needed to decrypt this key later on.
      *
      * @param keyAlias KeyStore alias for key to use
      * @param value    a value to encrypt
      * @return encrypted value, null if unable to encrypt
      */
     @Nullable
     private String encryptWithKeyStore(@NonNull String keyAlias, @Nullable byte[] value) {
         if (value == null) {
             logw(TAG, "Received a null key value.");
             return null;
         }

         Key key = getKeyStoreKey(keyAlias);
         try {
             Cipher cipher = Cipher.getInstance(CIPHER_TRANSFORMATION);
             cipher.init(Cipher.ENCRYPT_MODE, key);
             return Base64.encodeToString(cipher.doFinal(value), Base64.DEFAULT)
                     + IV_SPEC_SEPARATOR
                     + Base64.encodeToString(cipher.getIV(), Base64.DEFAULT);
         } catch (IllegalBlockSizeException
                 | BadPaddingException
                 | NoSuchAlgorithmException
                 | NoSuchPaddingException
                 | IllegalStateException
                 | InvalidKeyException e) {
             loge(TAG, "Unable to encrypt value with key " + keyAlias, e);
             return null;
         }
     }

     /**
      * Decrypt value with designated key
      *
      * @param keyAlias KeyStore alias for key to use
      * @param value    encrypted value
      * @return decrypted value, null if unable to decrypt
      */
     @Nullable
     private byte[] decryptWithKeyStore(
             @NonNull String keyAlias, @Nullable byte[] value, @NonNull byte[] ivSpec) {
         if (value == null) {
             return null;
         }

         try {
             Key key = getKeyStoreKey(keyAlias);
             Cipher cipher = Cipher.getInstance(CIPHER_TRANSFORMATION);
             cipher.init(
                     Cipher.DECRYPT_MODE, key,
                     new GCMParameterSpec(GCM_AUTHENTICATION_TAG_LENGTH, ivSpec));
             return cipher.doFinal(value);
         } catch (IllegalBlockSizeException
                 | BadPaddingException
                 | NoSuchAlgorithmException
                 | NoSuchPaddingException
                 | IllegalStateException
                 | InvalidKeyException
                 | InvalidAlgorithmParameterException e) {
             loge(TAG, "Unable to decrypt value with key " + keyAlias, e);
             return null;
         }
     }

     @Nullable
     private static Key getKeyStoreKey(@NonNull String keyAlias) {
         KeyStore keyStore;
         try {
             keyStore = KeyStore.getInstance(KEYSTORE_PROVIDER);
             keyStore.load(null);
             if (!keyStore.containsAlias(keyAlias)) {
                 KeyGenerator keyGenerator =
                         KeyGenerator.getInstance(KeyProperties.KEY_ALGORITHM_AES,
                                 KEYSTORE_PROVIDER);
                 keyGenerator.init(
                         new KeyGenParameterSpec.Builder(
                                 keyAlias,
                                 KeyProperties.PURPOSE_ENCRYPT | KeyProperties.PURPOSE_DECRYPT)
                                 .setBlockModes(KeyProperties.BLOCK_MODE_GCM)
                                 .setEncryptionPaddings(KeyProperties.ENCRYPTION_PADDING_NONE)
                                 .build());
                 keyGenerator.generateKey();
             }
             return keyStore.getKey(keyAlias, null);

         } catch (KeyStoreException
                 | NoSuchAlgorithmException
                 | UnrecoverableKeyException
                 | NoSuchProviderException
                 | CertificateException
                 | IOException
                 | InvalidAlgorithmParameterException e) {
             loge(TAG, "Unable to retrieve key " + keyAlias + " from KeyStore.", e);
             throw new IllegalStateException(e);
         }
     }

     @NonNull
     private SharedPreferences getSharedPrefs() {
         // This should be called only after user 0 is unlocked.
         if (mSharedPreferences != null) {
             return mSharedPreferences;
         }
         mSharedPreferences = mContext.getSharedPreferences(
                 mContext.getString(R.string.connected_device_shared_preferences),
                 Context.MODE_PRIVATE);
         return mSharedPreferences;

     }

     /**
      * Get the unique id for head unit. Persists on device until factory reset. This should be
      * called only after user 0 is unlocked.
      *
      * @return unique id
      */
     @NonNull
     public UUID getUniqueId() {
         if (mUniqueId != null) {
             return mUniqueId;
         }

         SharedPreferences prefs = getSharedPrefs();
         if (prefs.contains(UNIQUE_ID_KEY)) {
             mUniqueId = UUID.fromString(prefs.getString(UNIQUE_ID_KEY, null));
             logd(TAG,
                     "Found existing trusted unique id: " + prefs.getString(UNIQUE_ID_KEY, ""));
         }

         if (mUniqueId == null) {
             mUniqueId = UUID.randomUUID();
             prefs.edit().putString(UNIQUE_ID_KEY, mUniqueId.toString()).apply();
             logd(TAG,
                     "Generated new trusted unique id: " + prefs.getString(UNIQUE_ID_KEY, ""));
         }

         return mUniqueId;
     }

     /** Store the current bluetooth adapter name. */
     public void storeBluetoothName(@NonNull String name) {
         getSharedPrefs().edit().putString(BT_NAME_KEY, name).apply();
     }

     /** Get the previously stored bluetooth adapter name or {@code null} if not found. */
     @Nullable
     public String getStoredBluetoothName() {
         return getSharedPrefs().getString(BT_NAME_KEY, null);
     }

     /** Remove the previously stored bluetooth adapter name from storage. */
     public void removeStoredBluetoothName() {
         getSharedPrefs().edit().remove(BT_NAME_KEY).apply();
     }

     /**
      * Get a list of associated devices for the given user.
      *
      * @param userId The identifier of the user.
      * @return Associated device list.
      */
     @NonNull
     public List<AssociatedDevice> getAssociatedDevicesForUser(@NonNull int userId) {
         List<AssociatedDeviceEntity> entities =
                 mAssociatedDeviceDatabase.getAssociatedDevicesForUser(userId);

         if (entities == null) {
             return new ArrayList<>();
         }

         ArrayList<AssociatedDevice> userDevices = new ArrayList<>();
         for (AssociatedDeviceEntity entity : entities) {
             userDevices.add(entity.toAssociatedDevice());
         }

         return userDevices;
     }

     /**
      * Get a list of associated devices for the current user.
      *
      * @return Associated device list.
      */
     @NonNull
     public List<AssociatedDevice> getActiveUserAssociatedDevices() {
         return getAssociatedDevicesForUser(ActivityManager.getCurrentUser());
     }

     /**
      * Returns a list of device ids of associated devices for the given user.
      *
      * @param userId The user id for whom we want to know the device ids.
      * @return List of device ids.
      */
     @NonNull
     public List<String> getAssociatedDeviceIdsForUser(@NonNull int userId) {
         List<AssociatedDevice> userDevices = getAssociatedDevicesForUser(userId);
         ArrayList<String> userDeviceIds = new ArrayList<>();

         for (AssociatedDevice device : userDevices) {
             userDeviceIds.add(device.getDeviceId());
         }

         return userDeviceIds;
     }

     /**
      * Returns a list of device ids of associated devices for the current user.
      *
      * @return List of device ids.
      */
     @NonNull
     public List<String> getActiveUserAssociatedDeviceIds() {
         return getAssociatedDeviceIdsForUser(ActivityManager.getCurrentUser());
     }

     /**
      * Add the associated device of the given deviceId for the currently active user.
      *
      * @param device New associated device to be added.
      */
     public void addAssociatedDeviceForActiveUser(@NonNull AssociatedDevice device) {
         addAssociatedDeviceForUser(ActivityManager.getCurrentUser(), device);
         if (mAssociatedDeviceCallback != null) {
             mAssociatedDeviceCallback.onAssociatedDeviceAdded(device);
         }
     }


     /**
      * Add the associated device of the given deviceId for the given user.
      *
      * @param userId The identifier of the user.
      * @param device New associated device to be added.
      */
     public void addAssociatedDeviceForUser(int userId, @NonNull AssociatedDevice device) {
         AssociatedDeviceEntity entity = new AssociatedDeviceEntity(userId, device,
                 /* isConnectionEnabled= */ true);
         mAssociatedDeviceDatabase.addOrReplaceAssociatedDevice(entity);
     }

     /**
      * Update the name for an associated device.
      *
      * @param deviceId The id of the associated device.
      * @param name The name to replace with.
      */
     public void updateAssociatedDeviceName(@NonNull String deviceId, @NonNull String name) {
         AssociatedDeviceEntity entity = mAssociatedDeviceDatabase.getAssociatedDevice(deviceId);
         if (entity == null) {
             logw(TAG, "Attempt to update name on an unrecognized device " + deviceId
                     + ". Ignoring.");
             return;
         }
         entity.name = name;
         mAssociatedDeviceDatabase.addOrReplaceAssociatedDevice(entity);
         if (mAssociatedDeviceCallback != null) {
             mAssociatedDeviceCallback.onAssociatedDeviceUpdated(new AssociatedDevice(deviceId,
                     entity.address, name, entity.isConnectionEnabled));
         }
     }

     /**
      * Remove the associated device of the given deviceId for the given user.
      *
      * @param userId The identifier of the user.
      * @param deviceId The identifier of the device to be cleared.
      */
     public void removeAssociatedDevice(int userId, @NonNull String deviceId) {
         AssociatedDeviceEntity entity = mAssociatedDeviceDatabase.getAssociatedDevice(deviceId);
         if (entity == null || entity.userId != userId) {
             return;
         }
         mAssociatedDeviceDatabase.removeAssociatedDevice(entity);
         if (mAssociatedDeviceCallback != null) {
             mAssociatedDeviceCallback.onAssociatedDeviceRemoved(new AssociatedDevice(deviceId,
                     entity.address, entity.name, entity.isConnectionEnabled));
         }
     }

     /**
      * Clear the associated device of the given deviceId for the current user.
      *
      * @param deviceId The identifier of the device to be cleared.
      */
     public void removeAssociatedDeviceForActiveUser(@NonNull String deviceId) {
         removeAssociatedDevice(ActivityManager.getCurrentUser(), deviceId);
     }

     /**
      * Set if connection is enabled for an associated device.
      *
      * @param deviceId The id of the associated device.
      * @param isConnectionEnabled If connection enabled for this device.
      */
     public void updateAssociatedDeviceConnectionEnabled(@NonNull String deviceId,
             boolean isConnectionEnabled) {
         AssociatedDeviceEntity entity = mAssociatedDeviceDatabase.getAssociatedDevice(deviceId);
         if (entity == null) {
             logw(TAG, "Attempt to enable or disable connection on an unrecognized device "
                     + deviceId + ". Ignoring.");
             return;
         }
         if (entity.isConnectionEnabled == isConnectionEnabled) {
             return;
         }
         entity.isConnectionEnabled = isConnectionEnabled;
         mAssociatedDeviceDatabase.addOrReplaceAssociatedDevice(entity);
         if (mAssociatedDeviceCallback != null) {
             mAssociatedDeviceCallback.onAssociatedDeviceUpdated(new AssociatedDevice(deviceId,
                     entity.address, entity.name, isConnectionEnabled));
         }
     }

     /** Callback for association device related events. */
     public interface AssociatedDeviceCallback {
         /** Triggered when an associated device has been added. */
         void onAssociatedDeviceAdded(@NonNull AssociatedDevice device);

         /** Triggered when an associated device has been removed. */
         void onAssociatedDeviceRemoved(@NonNull AssociatedDevice device);

         /** Triggered when an associated device has been updated. */
         void onAssociatedDeviceUpdated(@NonNull AssociatedDevice device);
     }
 }
	/*
	* Copyright (C) 2019 The Android Open Source Project
	*
	* Licensed under the Apache License, Version 2.0 (the "License");
	* you may not use this file except in compliance with the License.
	* You may obtain a copy of the License at
	*
	* http://www.apache.org/licenses/LICENSE-2.0
	*
	* Unless required by applicable law or agreed to in writing, software
	* distributed under the License is distributed on an "AS IS" BASIS,
	* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
	* See the License for the specific language governing permissions and
	* limitations under the License.
	*/

	package com.android.car.connecteddevice.storage;

	import static com.android.car.connecteddevice.util.SafeLog.logd;
	import static com.android.car.connecteddevice.util.SafeLog.loge;
	import static com.android.car.connecteddevice.util.SafeLog.logw;

	import android.annotation.NonNull;
	import android.annotation.Nullable;
	import android.app.ActivityManager;
	import android.content.Context;
	import android.content.SharedPreferences;
	import android.security.keystore.KeyGenParameterSpec;
	import android.security.keystore.KeyProperties;
	import android.util.Base64;

	import androidx.room.Room;

	import com.android.car.connecteddevice.R;
	import com.android.car.connecteddevice.model.AssociatedDevice;
	import com.android.internal.annotations.VisibleForTesting;

	import java.io.IOException;
	import java.security.InvalidAlgorithmParameterException;
	import java.security.InvalidKeyException;
	import java.security.InvalidParameterException;
	import java.security.Key;
	import java.security.KeyStore;
	import java.security.KeyStoreException;
	import java.security.NoSuchAlgorithmException;
	import java.security.NoSuchProviderException;
	import java.security.UnrecoverableKeyException;
	import java.security.cert.CertificateException;
	import java.util.ArrayList;
	import java.util.List;
	import java.util.UUID;

	import javax.crypto.BadPaddingException;
	import javax.crypto.Cipher;
	import javax.crypto.IllegalBlockSizeException;
	import javax.crypto.KeyGenerator;
	import javax.crypto.Mac;
	import javax.crypto.NoSuchPaddingException;
	import javax.crypto.spec.GCMParameterSpec;
	import javax.crypto.spec.SecretKeySpec;

	/** Storage for connected devices in a car. */
	public class ConnectedDeviceStorage {
	private static final String TAG = "CompanionStorage";

	private static final String UNIQUE_ID_KEY = "CTABM_unique_id";
	private static final String BT_NAME_KEY = "CTABM_bt_name";
	private static final String KEY_ALIAS = "Ukey2Key";
	private static final String CIPHER_TRANSFORMATION = "AES/GCM/NoPadding";
	private static final String KEYSTORE_PROVIDER = "AndroidKeyStore";
	private static final String DATABASE_NAME = "connected-device-database";
	private static final String IV_SPEC_SEPARATOR = ";";

	private static final String CHALLENGE_HASHING_ALGORITHM = "HmacSHA256";
	// This delimiter separates deviceId and deviceInfo, so it has to differ from the
	// TrustedDeviceInfo delimiter. Once new API can be added, deviceId will be added to
	// TrustedDeviceInfo and this delimiter will be removed.

	// The length of the authentication tag for a cipher in GCM mode. The GCM specification states
	// that this length can only have the values {128, 120, 112, 104, 96}. Using the highest
	// possible value.
	private static final int GCM_AUTHENTICATION_TAG_LENGTH = 128;

	@VisibleForTesting
	static final int CHALLENGE_SECRET_BYTES = 32;

	private final Context mContext;

	private SharedPreferences mSharedPreferences;

	private UUID mUniqueId;

	private AssociatedDeviceDao mAssociatedDeviceDatabase;

	private AssociatedDeviceCallback mAssociatedDeviceCallback;

	public ConnectedDeviceStorage(@NonNull Context context) {
	mContext = context;
	mAssociatedDeviceDatabase = Room.databaseBuilder(context, ConnectedDeviceDatabase.class,
	DATABASE_NAME)
	.fallbackToDestructiveMigration()
	.build()
	.associatedDeviceDao();
	}

	/**
	* Set a callback for associated device updates.
	*
	* @param callback {@link AssociatedDeviceCallback} to set.
	*/
	public void setAssociatedDeviceCallback(
	@NonNull AssociatedDeviceCallback callback) {
	mAssociatedDeviceCallback = callback;
	}

	/** Clear the callback for association device callback updates. */
	public void clearAssociationDeviceCallback() {
	mAssociatedDeviceCallback = null;
	}

	/**
	* Get communication encryption key for the given device.
	*
	* @param deviceId id of trusted device
	* @return encryption key, null if device id is not recognized
	*/
	@Nullable
	public byte[] getEncryptionKey(@NonNull String deviceId) {
	AssociatedDeviceKeyEntity entity =
	mAssociatedDeviceDatabase.getAssociatedDeviceKey(deviceId);
	if (entity == null) {
	logd(TAG, "Encryption key not found!");
	return null;
	}
	String[] values = entity.encryptedKey.split(IV_SPEC_SEPARATOR, -1);

	if (values.length != 2) {
	logd(TAG, "Stored encryption key had the wrong length.");
	return null;
	}

	byte[] encryptedKey = Base64.decode(values[0], Base64.DEFAULT);
	byte[] ivSpec = Base64.decode(values[1], Base64.DEFAULT);
	return decryptWithKeyStore(KEY_ALIAS, encryptedKey, ivSpec);
	}

	/**
	* Save encryption key for the given device.
	*
	* @param deviceId id of the device
	* @param encryptionKey encryption key
	*/
	public void saveEncryptionKey(@NonNull String deviceId, @NonNull byte[] encryptionKey) {
	String encryptedKey = encryptWithKeyStore(KEY_ALIAS, encryptionKey);
	AssociatedDeviceKeyEntity entity = new AssociatedDeviceKeyEntity(deviceId, encryptedKey);
	mAssociatedDeviceDatabase.addOrReplaceAssociatedDeviceKey(entity);
	logd(TAG, "Successfully wrote encryption key.");
	}

	/**
	* Save challenge secret for the given device.
	*
	* @param deviceId id of the device
	* @param secret Secret associated with this device. Note: must be
	* {@value CHALLENGE_SECRET_BYTES} bytes in length or an
	* {@link InvalidParameterException} will be thrown.
	*/
	public void saveChallengeSecret(@NonNull String deviceId, @NonNull byte[] secret) {
	if (secret.length != CHALLENGE_SECRET_BYTES) {
	throw new InvalidParameterException("Secrets must be " + CHALLENGE_SECRET_BYTES
	+ " bytes in length.");
	}

	String encryptedKey = encryptWithKeyStore(KEY_ALIAS, secret);
	AssociatedDeviceChallengeSecretEntity entity = new AssociatedDeviceChallengeSecretEntity(
	deviceId, encryptedKey);
	mAssociatedDeviceDatabase.addOrReplaceAssociatedDeviceChallengeSecret(entity);
	logd(TAG, "Successfully wrote challenge secret.");
	}

	/** Get the challenge secret associated with a device. */
	public byte[] getChallengeSecret(@NonNull String deviceId) {
	AssociatedDeviceChallengeSecretEntity entity =
	mAssociatedDeviceDatabase.getAssociatedDeviceChallengeSecret(deviceId);
	if (entity == null) {
	logd(TAG, "Challenge secret not found!");
	return null;
	}
	String[] values = entity.encryptedChallengeSecret.split(IV_SPEC_SEPARATOR, -1);

	if (values.length != 2) {
	logd(TAG, "Stored encryption key had the wrong length.");
	return null;
	}

	byte[] encryptedSecret = Base64.decode(values[0], Base64.DEFAULT);
	byte[] ivSpec = Base64.decode(values[1], Base64.DEFAULT);
	return decryptWithKeyStore(KEY_ALIAS, encryptedSecret, ivSpec);
	}

	/**
	* Hash provided value with device's challenge secret and return result. Returns {@code null} if
	* unsuccessful.
	*/
	@Nullable
	public byte[] hashWithChallengeSecret(@NonNull String deviceId, @NonNull byte[] value) {
	byte[] challengeSecret = getChallengeSecret(deviceId);
	if (challengeSecret == null) {
	loge(TAG, "Unable to find challenge secret for device " + deviceId + ".");
	return null;
	}

	Mac mac;
	try {
	mac = Mac.getInstance(CHALLENGE_HASHING_ALGORITHM);
	} catch (NoSuchAlgorithmException e) {
	loge(TAG, "Unable to find hashing algorithm " + CHALLENGE_HASHING_ALGORITHM + ".", e);
	return null;
	}

	SecretKeySpec keySpec = new SecretKeySpec(challengeSecret, CHALLENGE_HASHING_ALGORITHM);
	try {
	mac.init(keySpec);
	} catch (InvalidKeyException e) {
	loge(TAG, "Exception while initializing HMAC.", e);
	return null;
	}

	return mac.doFinal(value);
	}

	/**
	* Encrypt value with designated key
	*
	* <p>The encrypted value is of the form:
	*
	* <p>key + IV_SPEC_SEPARATOR + ivSpec
	*
	* <p>The {@code ivSpec} is needed to decrypt this key later on.
	*
	* @param keyAlias KeyStore alias for key to use
	* @param value a value to encrypt
	* @return encrypted value, null if unable to encrypt
	*/
	@Nullable
	private String encryptWithKeyStore(@NonNull String keyAlias, @Nullable byte[] value) {
	if (value == null) {
	logw(TAG, "Received a null key value.");
	return null;
	}

	Key key = getKeyStoreKey(keyAlias);
	try {
	Cipher cipher = Cipher.getInstance(CIPHER_TRANSFORMATION);
	cipher.init(Cipher.ENCRYPT_MODE, key);
	return Base64.encodeToString(cipher.doFinal(value), Base64.DEFAULT)
	+ IV_SPEC_SEPARATOR
	+ Base64.encodeToString(cipher.getIV(), Base64.DEFAULT);
	} catch (IllegalBlockSizeException
	\| BadPaddingException
	\| NoSuchAlgorithmException
	\| NoSuchPaddingException
	\| IllegalStateException
	\| InvalidKeyException e) {
	loge(TAG, "Unable to encrypt value with key " + keyAlias, e);
	return null;
	}
	}

	/**
	* Decrypt value with designated key
	*
	* @param keyAlias KeyStore alias for key to use
	* @param value encrypted value
	* @return decrypted value, null if unable to decrypt
	*/
	@Nullable
	private byte[] decryptWithKeyStore(
	@NonNull String keyAlias, @Nullable byte[] value, @NonNull byte[] ivSpec) {
	if (value == null) {
	return null;
	}

	try {
	Key key = getKeyStoreKey(keyAlias);
	Cipher cipher = Cipher.getInstance(CIPHER_TRANSFORMATION);
	cipher.init(
	Cipher.DECRYPT_MODE, key,
	new GCMParameterSpec(GCM_AUTHENTICATION_TAG_LENGTH, ivSpec));
	return cipher.doFinal(value);
	} catch (IllegalBlockSizeException
	\| BadPaddingException
	\| NoSuchAlgorithmException
	\| NoSuchPaddingException
	\| IllegalStateException
	\| InvalidKeyException
	\| InvalidAlgorithmParameterException e) {
	loge(TAG, "Unable to decrypt value with key " + keyAlias, e);
	return null;
	}
	}

	@Nullable
	private static Key getKeyStoreKey(@NonNull String keyAlias) {
	KeyStore keyStore;
	try {
	keyStore = KeyStore.getInstance(KEYSTORE_PROVIDER);
	keyStore.load(null);
	if (!keyStore.containsAlias(keyAlias)) {
	KeyGenerator keyGenerator =
	KeyGenerator.getInstance(KeyProperties.KEY_ALGORITHM_AES,
	KEYSTORE_PROVIDER);
	keyGenerator.init(
	new KeyGenParameterSpec.Builder(
	keyAlias,
	KeyProperties.PURPOSE_ENCRYPT \| KeyProperties.PURPOSE_DECRYPT)
	.setBlockModes(KeyProperties.BLOCK_MODE_GCM)
	.setEncryptionPaddings(KeyProperties.ENCRYPTION_PADDING_NONE)
	.build());
	keyGenerator.generateKey();
	}
	return keyStore.getKey(keyAlias, null);

	} catch (KeyStoreException
	\| NoSuchAlgorithmException
	\| UnrecoverableKeyException
	\| NoSuchProviderException
	\| CertificateException
	\| IOException
	\| InvalidAlgorithmParameterException e) {
	loge(TAG, "Unable to retrieve key " + keyAlias + " from KeyStore.", e);
	throw new IllegalStateException(e);
	}
	}

	@NonNull
	private SharedPreferences getSharedPrefs() {
	// This should be called only after user 0 is unlocked.
	if (mSharedPreferences != null) {
	return mSharedPreferences;
	}
	mSharedPreferences = mContext.getSharedPreferences(
	mContext.getString(R.string.connected_device_shared_preferences),
	Context.MODE_PRIVATE);
	return mSharedPreferences;

	}

	/**
	* Get the unique id for head unit. Persists on device until factory reset. This should be
	* called only after user 0 is unlocked.
	*
	* @return unique id
	*/
	@NonNull
	public UUID getUniqueId() {
	if (mUniqueId != null) {
	return mUniqueId;
	}

	SharedPreferences prefs = getSharedPrefs();
	if (prefs.contains(UNIQUE_ID_KEY)) {
	mUniqueId = UUID.fromString(prefs.getString(UNIQUE_ID_KEY, null));
	logd(TAG,
	"Found existing trusted unique id: " + prefs.getString(UNIQUE_ID_KEY, ""));
	}

	if (mUniqueId == null) {
	mUniqueId = UUID.randomUUID();
	prefs.edit().putString(UNIQUE_ID_KEY, mUniqueId.toString()).apply();
	logd(TAG,
	"Generated new trusted unique id: " + prefs.getString(UNIQUE_ID_KEY, ""));
	}

	return mUniqueId;
	}

	/** Store the current bluetooth adapter name. */
	public void storeBluetoothName(@NonNull String name) {
	getSharedPrefs().edit().putString(BT_NAME_KEY, name).apply();
	}

	/** Get the previously stored bluetooth adapter name or {@code null} if not found. */
	@Nullable
	public String getStoredBluetoothName() {
	return getSharedPrefs().getString(BT_NAME_KEY, null);
	}

	/** Remove the previously stored bluetooth adapter name from storage. */
	public void removeStoredBluetoothName() {
	getSharedPrefs().edit().remove(BT_NAME_KEY).apply();
	}

	/**
	* Get a list of associated devices for the given user.
	*
	* @param userId The identifier of the user.
	* @return Associated device list.
	*/
	@NonNull
	public List<AssociatedDevice> getAssociatedDevicesForUser(@NonNull int userId) {
	List<AssociatedDeviceEntity> entities =
	mAssociatedDeviceDatabase.getAssociatedDevicesForUser(userId);

	if (entities == null) {
	return new ArrayList<>();
	}

	ArrayList<AssociatedDevice> userDevices = new ArrayList<>();
	for (AssociatedDeviceEntity entity : entities) {
	userDevices.add(entity.toAssociatedDevice());
	}

	return userDevices;
	}

	/**
	* Get a list of associated devices for the current user.
	*
	* @return Associated device list.
	*/
	@NonNull
	public List<AssociatedDevice> getActiveUserAssociatedDevices() {
	return getAssociatedDevicesForUser(ActivityManager.getCurrentUser());
	}

	/**
	* Returns a list of device ids of associated devices for the given user.
	*
	* @param userId The user id for whom we want to know the device ids.
	* @return List of device ids.
	*/
	@NonNull
	public List<String> getAssociatedDeviceIdsForUser(@NonNull int userId) {
	List<AssociatedDevice> userDevices = getAssociatedDevicesForUser(userId);
	ArrayList<String> userDeviceIds = new ArrayList<>();

	for (AssociatedDevice device : userDevices) {
	userDeviceIds.add(device.getDeviceId());
	}

	return userDeviceIds;
	}

	/**
	* Returns a list of device ids of associated devices for the current user.
	*
	* @return List of device ids.
	*/
	@NonNull
	public List<String> getActiveUserAssociatedDeviceIds() {
	return getAssociatedDeviceIdsForUser(ActivityManager.getCurrentUser());
	}

	/**
	* Add the associated device of the given deviceId for the currently active user.
	*
	* @param device New associated device to be added.
	*/
	public void addAssociatedDeviceForActiveUser(@NonNull AssociatedDevice device) {
	addAssociatedDeviceForUser(ActivityManager.getCurrentUser(), device);
	if (mAssociatedDeviceCallback != null) {
	mAssociatedDeviceCallback.onAssociatedDeviceAdded(device);
	}
	}


	/**
	* Add the associated device of the given deviceId for the given user.
	*
	* @param userId The identifier of the user.
	* @param device New associated device to be added.
	*/
	public void addAssociatedDeviceForUser(int userId, @NonNull AssociatedDevice device) {
	AssociatedDeviceEntity entity = new AssociatedDeviceEntity(userId, device,
	/* isConnectionEnabled= */ true);
	mAssociatedDeviceDatabase.addOrReplaceAssociatedDevice(entity);
	}

	/**
	* Update the name for an associated device.
	*
	* @param deviceId The id of the associated device.
	* @param name The name to replace with.
	*/
	public void updateAssociatedDeviceName(@NonNull String deviceId, @NonNull String name) {
	AssociatedDeviceEntity entity = mAssociatedDeviceDatabase.getAssociatedDevice(deviceId);
	if (entity == null) {
	logw(TAG, "Attempt to update name on an unrecognized device " + deviceId
	+ ". Ignoring.");
	return;
	}
	entity.name = name;
	mAssociatedDeviceDatabase.addOrReplaceAssociatedDevice(entity);
	if (mAssociatedDeviceCallback != null) {
	mAssociatedDeviceCallback.onAssociatedDeviceUpdated(new AssociatedDevice(deviceId,
	entity.address, name, entity.isConnectionEnabled));
	}
	}

	/**
	* Remove the associated device of the given deviceId for the given user.
	*
	* @param userId The identifier of the user.
	* @param deviceId The identifier of the device to be cleared.
	*/
	public void removeAssociatedDevice(int userId, @NonNull String deviceId) {
	AssociatedDeviceEntity entity = mAssociatedDeviceDatabase.getAssociatedDevice(deviceId);
	if (entity == null \|\| entity.userId != userId) {
	return;
	}
	mAssociatedDeviceDatabase.removeAssociatedDevice(entity);
	if (mAssociatedDeviceCallback != null) {
	mAssociatedDeviceCallback.onAssociatedDeviceRemoved(new AssociatedDevice(deviceId,
	entity.address, entity.name, entity.isConnectionEnabled));
	}
	}

	/**
	* Clear the associated device of the given deviceId for the current user.
	*
	* @param deviceId The identifier of the device to be cleared.
	*/
	public void removeAssociatedDeviceForActiveUser(@NonNull String deviceId) {
	removeAssociatedDevice(ActivityManager.getCurrentUser(), deviceId);
	}

	/**
	* Set if connection is enabled for an associated device.
	*
	* @param deviceId The id of the associated device.
	* @param isConnectionEnabled If connection enabled for this device.
	*/
	public void updateAssociatedDeviceConnectionEnabled(@NonNull String deviceId,
	boolean isConnectionEnabled) {
	AssociatedDeviceEntity entity = mAssociatedDeviceDatabase.getAssociatedDevice(deviceId);
	if (entity == null) {
	logw(TAG, "Attempt to enable or disable connection on an unrecognized device "
	+ deviceId + ". Ignoring.");
	return;
	}
	if (entity.isConnectionEnabled == isConnectionEnabled) {
	return;
	}
	entity.isConnectionEnabled = isConnectionEnabled;
	mAssociatedDeviceDatabase.addOrReplaceAssociatedDevice(entity);
	if (mAssociatedDeviceCallback != null) {
	mAssociatedDeviceCallback.onAssociatedDeviceUpdated(new AssociatedDevice(deviceId,
	entity.address, entity.name, isConnectionEnabled));
	}
	}

	/** Callback for association device related events. */
	public interface AssociatedDeviceCallback {
	/** Triggered when an associated device has been added. */
	void onAssociatedDeviceAdded(@NonNull AssociatedDevice device);

	/** Triggered when an associated device has been removed. */
	void onAssociatedDeviceRemoved(@NonNull AssociatedDevice device);

	/** Triggered when an associated device has been updated. */
	void onAssociatedDeviceUpdated(@NonNull AssociatedDevice device);
	}
	}