Add APIs for notifying cell identifier disclosures, security algorithm updates

Adds the new (1) CellularIdentifierDisclosedListener API, which allows
listeners to determine when certain sensitive identifiers (IMEI, IMSI,
unencrypted SUCI) are disclosed over the radio network from the modem.
Also adds the new (2) SecurityAlgorithmsListener API, which allows
listeners to receive updates from the modem about which radio security
algorithms are in use.

Bug: 355062720
Test: atest CtsTelephonyTestCases:TelephonyCallbackTest
Test: atest FrameworksTelephonyTest DefaultPhoneNotifierTest
Test: atest CellularIdentifierDisclosureTest SecurityAlgorithmUpdateTest
Flag: com.android.internal.telephony.flags.security_algorithms_update_indications
Flag: com.android.internal.telephony.flags.cellular_identifier_disclosure_indications

Change-Id: I7472b9c624f55aa371c3d0871961b2ddcd7e793f

12 files changed, 668 insertions, 135 deletions

diff --git a/core/api/system-current.txt b/core/api/system-current.txt
index e4f158202125..829c980034d3 100644
--- a/core/api/system-current.txt
+++ b/core/api/system-current.txt
@@ -15101,6 +15101,32 @@ package android.telephony {
     method @NonNull public android.telephony.CellIdentityWcdma sanitizeLocationInfo();
   }
 
+  @FlaggedApi("com.android.internal.telephony.flags.cellular_identifier_disclosure_indications") public final class CellularIdentifierDisclosure implements android.os.Parcelable {
+    method public int describeContents();
+    method public int getCellularIdentifier();
+    method public int getNasProtocolMessage();
+    method @NonNull public String getPlmn();
+    method public boolean isEmergency();
+    method public void writeToParcel(@NonNull android.os.Parcel, int);
+    field public static final int CELLULAR_IDENTIFIER_IMEI = 2; // 0x2
+    field public static final int CELLULAR_IDENTIFIER_IMSI = 1; // 0x1
+    field public static final int CELLULAR_IDENTIFIER_SUCI = 3; // 0x3
+    field public static final int CELLULAR_IDENTIFIER_UNKNOWN = 0; // 0x0
+    field @NonNull public static final android.os.Parcelable.Creator<android.telephony.CellularIdentifierDisclosure> CREATOR;
+    field public static final int NAS_PROTOCOL_MESSAGE_ATTACH_REQUEST = 1; // 0x1
+    field public static final int NAS_PROTOCOL_MESSAGE_AUTHENTICATION_AND_CIPHERING_RESPONSE = 6; // 0x6
+    field public static final int NAS_PROTOCOL_MESSAGE_CM_REESTABLISHMENT_REQUEST = 9; // 0x9
+    field public static final int NAS_PROTOCOL_MESSAGE_CM_SERVICE_REQUEST = 10; // 0xa
+    field public static final int NAS_PROTOCOL_MESSAGE_DEREGISTRATION_REQUEST = 8; // 0x8
+    field public static final int NAS_PROTOCOL_MESSAGE_DETACH_REQUEST = 3; // 0x3
+    field public static final int NAS_PROTOCOL_MESSAGE_IDENTITY_RESPONSE = 2; // 0x2
+    field public static final int NAS_PROTOCOL_MESSAGE_IMSI_DETACH_INDICATION = 11; // 0xb
+    field public static final int NAS_PROTOCOL_MESSAGE_LOCATION_UPDATE_REQUEST = 5; // 0x5
+    field public static final int NAS_PROTOCOL_MESSAGE_REGISTRATION_REQUEST = 7; // 0x7
+    field public static final int NAS_PROTOCOL_MESSAGE_TRACKING_AREA_UPDATE_REQUEST = 4; // 0x4
+    field public static final int NAS_PROTOCOL_MESSAGE_UNKNOWN = 0; // 0x0
+  }
+
   public final class DataFailCause {
     field @Deprecated public static final int VSNCP_APN_UNATHORIZED = 2238; // 0x8be
   }
@@ -15552,6 +15578,75 @@ package android.telephony {
     field public static final int USER_NOT_MEMBER_OF_CUG = 87; // 0x57
   }
 
+  @FlaggedApi("com.android.internal.telephony.flags.security_algorithms_update_indications") public final class SecurityAlgorithmUpdate implements android.os.Parcelable {
+    method public int describeContents();
+    method public int getConnectionEvent();
+    method public int getEncryption();
+    method public int getIntegrity();
+    method public boolean isUnprotectedEmergency();
+    method public void writeToParcel(@NonNull android.os.Parcel, int);
+    field public static final int CONNECTION_EVENT_AS_SIGNALLING_5G = 11; // 0xb
+    field public static final int CONNECTION_EVENT_AS_SIGNALLING_LTE = 5; // 0x5
+    field public static final int CONNECTION_EVENT_CS_SIGNALLING_3G = 2; // 0x2
+    field public static final int CONNECTION_EVENT_CS_SIGNALLING_GSM = 0; // 0x0
+    field public static final int CONNECTION_EVENT_NAS_SIGNALLING_5G = 10; // 0xa
+    field public static final int CONNECTION_EVENT_NAS_SIGNALLING_LTE = 4; // 0x4
+    field public static final int CONNECTION_EVENT_PS_SIGNALLING_3G = 3; // 0x3
+    field public static final int CONNECTION_EVENT_PS_SIGNALLING_GPRS = 1; // 0x1
+    field public static final int CONNECTION_EVENT_VOLTE_RTP = 8; // 0x8
+    field public static final int CONNECTION_EVENT_VOLTE_RTP_SOS = 9; // 0x9
+    field public static final int CONNECTION_EVENT_VOLTE_SIP = 6; // 0x6
+    field public static final int CONNECTION_EVENT_VOLTE_SIP_SOS = 7; // 0x7
+    field public static final int CONNECTION_EVENT_VONR_RTP = 14; // 0xe
+    field public static final int CONNECTION_EVENT_VONR_RTP_SOS = 15; // 0xf
+    field public static final int CONNECTION_EVENT_VONR_SIP = 12; // 0xc
+    field public static final int CONNECTION_EVENT_VONR_SIP_SOS = 13; // 0xd
+    field @NonNull public static final android.os.Parcelable.Creator<android.telephony.SecurityAlgorithmUpdate> CREATOR;
+    field public static final int SECURITY_ALGORITHM_A50 = 0; // 0x0
+    field public static final int SECURITY_ALGORITHM_A51 = 1; // 0x1
+    field public static final int SECURITY_ALGORITHM_A52 = 2; // 0x2
+    field public static final int SECURITY_ALGORITHM_A53 = 3; // 0x3
+    field public static final int SECURITY_ALGORITHM_A54 = 4; // 0x4
+    field public static final int SECURITY_ALGORITHM_AES_CBC = 71; // 0x47
+    field public static final int SECURITY_ALGORITHM_AES_EDE3_CBC = 73; // 0x49
+    field public static final int SECURITY_ALGORITHM_AES_GCM = 69; // 0x45
+    field public static final int SECURITY_ALGORITHM_AES_GMAC = 70; // 0x46
+    field public static final int SECURITY_ALGORITHM_AUTH_HMAC_SHA2_256_128 = 101; // 0x65
+    field public static final int SECURITY_ALGORITHM_DES_EDE3_CBC = 72; // 0x48
+    field public static final int SECURITY_ALGORITHM_EEA0 = 41; // 0x29
+    field public static final int SECURITY_ALGORITHM_EEA1 = 42; // 0x2a
+    field public static final int SECURITY_ALGORITHM_EEA2 = 43; // 0x2b
+    field public static final int SECURITY_ALGORITHM_EEA3 = 44; // 0x2c
+    field public static final int SECURITY_ALGORITHM_ENCR_AES_CBC = 100; // 0x64
+    field public static final int SECURITY_ALGORITHM_ENCR_AES_GCM_16 = 99; // 0x63
+    field public static final int SECURITY_ALGORITHM_GEA0 = 14; // 0xe
+    field public static final int SECURITY_ALGORITHM_GEA1 = 15; // 0xf
+    field public static final int SECURITY_ALGORITHM_GEA2 = 16; // 0x10
+    field public static final int SECURITY_ALGORITHM_GEA3 = 17; // 0x11
+    field public static final int SECURITY_ALGORITHM_GEA4 = 18; // 0x12
+    field public static final int SECURITY_ALGORITHM_GEA5 = 19; // 0x13
+    field public static final int SECURITY_ALGORITHM_HMAC_MD5_96 = 75; // 0x4b
+    field public static final int SECURITY_ALGORITHM_HMAC_SHA1_96 = 74; // 0x4a
+    field public static final int SECURITY_ALGORITHM_IMS_NULL = 67; // 0x43
+    field public static final int SECURITY_ALGORITHM_NEA0 = 55; // 0x37
+    field public static final int SECURITY_ALGORITHM_NEA1 = 56; // 0x38
+    field public static final int SECURITY_ALGORITHM_NEA2 = 57; // 0x39
+    field public static final int SECURITY_ALGORITHM_NEA3 = 58; // 0x3a
+    field public static final int SECURITY_ALGORITHM_ORYX = 124; // 0x7c
+    field public static final int SECURITY_ALGORITHM_OTHER = 114; // 0x72
+    field public static final int SECURITY_ALGORITHM_RTP = 85; // 0x55
+    field public static final int SECURITY_ALGORITHM_SIP_NO_IPSEC_CONFIG = 66; // 0x42
+    field public static final int SECURITY_ALGORITHM_SIP_NULL = 68; // 0x44
+    field public static final int SECURITY_ALGORITHM_SRTP_AES_COUNTER = 87; // 0x57
+    field public static final int SECURITY_ALGORITHM_SRTP_AES_F8 = 88; // 0x58
+    field public static final int SECURITY_ALGORITHM_SRTP_HMAC_SHA1 = 89; // 0x59
+    field public static final int SECURITY_ALGORITHM_SRTP_NULL = 86; // 0x56
+    field public static final int SECURITY_ALGORITHM_UEA0 = 29; // 0x1d
+    field public static final int SECURITY_ALGORITHM_UEA1 = 30; // 0x1e
+    field public static final int SECURITY_ALGORITHM_UEA2 = 31; // 0x1f
+    field public static final int SECURITY_ALGORITHM_UNKNOWN = 113; // 0x71
+  }
+
   public class ServiceState implements android.os.Parcelable {
     method @Nullable public android.telephony.NetworkRegistrationInfo getNetworkRegistrationInfo(int, int);
     method @NonNull public java.util.List<android.telephony.NetworkRegistrationInfo> getNetworkRegistrationInfoListForDomain(int);
@@ -15776,6 +15871,7 @@ package android.telephony {
     field @RequiresPermission(android.Manifest.permission.READ_PHONE_STATE) public static final int EVENT_CALL_FORWARDING_INDICATOR_CHANGED = 4; // 0x4
     field public static final int EVENT_CALL_STATE_CHANGED = 6; // 0x6
     field public static final int EVENT_CARRIER_NETWORK_CHANGED = 17; // 0x11
+    field @FlaggedApi("com.android.internal.telephony.flags.cellular_identifier_disclosure_indications") @RequiresPermission(android.Manifest.permission.READ_PRIVILEGED_PHONE_STATE) public static final int EVENT_CELLULAR_IDENTIFIER_DISCLOSED_CHANGED = 47; // 0x2f
     field @RequiresPermission(allOf={android.Manifest.permission.READ_PHONE_STATE, android.Manifest.permission.ACCESS_FINE_LOCATION}) public static final int EVENT_CELL_INFO_CHANGED = 11; // 0xb
     field @RequiresPermission(android.Manifest.permission.ACCESS_FINE_LOCATION) public static final int EVENT_CELL_LOCATION_CHANGED = 5; // 0x5
     field public static final int EVENT_DATA_ACTIVATION_STATE_CHANGED = 19; // 0x13
@@ -15800,6 +15896,7 @@ package android.telephony {
     field @RequiresPermission(android.Manifest.permission.READ_PRECISE_PHONE_STATE) public static final int EVENT_PRECISE_DATA_CONNECTION_STATE_CHANGED = 13; // 0xd
     field @RequiresPermission(android.Manifest.permission.READ_PRIVILEGED_PHONE_STATE) public static final int EVENT_RADIO_POWER_STATE_CHANGED = 24; // 0x18
     field @RequiresPermission(allOf={android.Manifest.permission.READ_PRECISE_PHONE_STATE, android.Manifest.permission.ACCESS_FINE_LOCATION}) public static final int EVENT_REGISTRATION_FAILURE = 31; // 0x1f
+    field @FlaggedApi("com.android.internal.telephony.flags.cellular_identifier_disclosure_indications") @RequiresPermission(android.Manifest.permission.READ_PRIVILEGED_PHONE_STATE) public static final int EVENT_SECURITY_ALGORITHMS_CHANGED = 46; // 0x2e
     field public static final int EVENT_SERVICE_STATE_CHANGED = 1; // 0x1
     field public static final int EVENT_SIGNAL_STRENGTHS_CHANGED = 9; // 0x9
     field public static final int EVENT_SIGNAL_STRENGTH_CHANGED = 2; // 0x2
@@ -15818,6 +15915,10 @@ package android.telephony {
     method @RequiresPermission(android.Manifest.permission.READ_PRECISE_PHONE_STATE) public default void onCallStatesChanged(@NonNull java.util.List<android.telephony.CallState>);
   }
 
+  @FlaggedApi("com.android.internal.telephony.flags.cellular_identifier_disclosure_indications") public static interface TelephonyCallback.CellularIdentifierDisclosedListener {
+    method public void onCellularIdentifierDisclosedChanged(@NonNull android.telephony.CellularIdentifierDisclosure);
+  }
+
   public static interface TelephonyCallback.DataEnabledListener {
     method @RequiresPermission(android.Manifest.permission.READ_PRECISE_PHONE_STATE) public void onDataEnabledChanged(boolean, int);
   }
@@ -15856,6 +15957,10 @@ package android.telephony {
     method @RequiresPermission(android.Manifest.permission.READ_PRIVILEGED_PHONE_STATE) public void onRadioPowerStateChanged(int);
   }
 
+  @FlaggedApi("com.android.internal.telephony.flags.security_algorithms_update_indications") public static interface TelephonyCallback.SecurityAlgorithmsListener {
+    method public void onSecurityAlgorithmsChanged(@NonNull android.telephony.SecurityAlgorithmUpdate);
+  }
+
   @FlaggedApi("com.android.internal.telephony.flags.simultaneous_calling_indications") public static interface TelephonyCallback.SimultaneousCellularCallingSupportListener {
     method @RequiresPermission(android.Manifest.permission.READ_PRIVILEGED_PHONE_STATE) public void onSimultaneousCellularCallingSubscriptionsChanged(@NonNull java.util.Set<java.lang.Integer>);
   }
diff --git a/core/api/test-current.txt b/core/api/test-current.txt
index 136c6365b313..69f242bfc415 100644
--- a/core/api/test-current.txt
+++ b/core/api/test-current.txt
@@ -3398,6 +3398,10 @@ package android.telephony {
     ctor public BarringInfo.BarringServiceInfo(int, boolean, int, int);
   }
 
+  @FlaggedApi("com.android.internal.telephony.flags.cellular_identifier_disclosure_indications") public final class CellularIdentifierDisclosure implements android.os.Parcelable {
+    ctor public CellularIdentifierDisclosure(int, int, @NonNull String, boolean);
+  }
+
   public class MbmsDownloadSession implements java.lang.AutoCloseable {
     field public static final String MBMS_DOWNLOAD_SERVICE_OVERRIDE_METADATA = "mbms-download-service-override";
   }
@@ -3425,6 +3429,10 @@ package android.telephony {
     ctor @Deprecated public PreciseDataConnectionState(int, int, int, @NonNull String, @Nullable android.net.LinkProperties, int);
   }
 
+  @FlaggedApi("com.android.internal.telephony.flags.security_algorithms_update_indications") public final class SecurityAlgorithmUpdate implements android.os.Parcelable {
+    ctor public SecurityAlgorithmUpdate(int, int, int, boolean);
+  }
+
   public class ServiceState implements android.os.Parcelable {
     method public void addNetworkRegistrationInfo(android.telephony.NetworkRegistrationInfo);
     method public int getDataNetworkType();
diff --git a/core/java/android/telephony/PhoneStateListener.java b/core/java/android/telephony/PhoneStateListener.java
index 1df3b4332754..c16a510ed729 100644
--- a/core/java/android/telephony/PhoneStateListener.java
+++ b/core/java/android/telephony/PhoneStateListener.java
@@ -1712,6 +1712,15 @@ public class PhoneStateListener {
                 @NonNull NtnSignalStrength ntnSignalStrength) {
             // not supported on the deprecated interface - Use TelephonyCallback instead
         }
+
+        public final void onSecurityAlgorithmsChanged(SecurityAlgorithmUpdate update) {
+            // not supported on the deprecated interface - Use TelephonyCallback instead
+        }
+
+        public final void onCellularIdentifierDisclosedChanged(
+                CellularIdentifierDisclosure disclosure) {
+            // not supported on the deprecated interface - Use TelephonyCallback instead
+        }
     }
 
     private void log(String s) {
diff --git a/core/java/android/telephony/TelephonyCallback.java b/core/java/android/telephony/TelephonyCallback.java
index 0d1dc4611343..2c585e640fdd 100644
--- a/core/java/android/telephony/TelephonyCallback.java
+++ b/core/java/android/telephony/TelephonyCallback.java
@@ -705,6 +705,28 @@ public class TelephonyCallback {
     public static final int EVENT_CARRIER_ROAMING_NTN_SIGNAL_STRENGTH_CHANGED = 45;
 
     /**
+     * Event for changes to mobile network ciphering algorithms.
+     * See {@link SecurityAlgorithmsListener#onSecurityAlgorithmsChanged}
+     *
+     * @hide
+     */
+    @FlaggedApi(Flags.FLAG_CELLULAR_IDENTIFIER_DISCLOSURE_INDICATIONS)
+    @RequiresPermission(android.Manifest.permission.READ_PRIVILEGED_PHONE_STATE)
+    @SystemApi
+    public static final int EVENT_SECURITY_ALGORITHMS_CHANGED = 46;
+
+     /**
+      * Event for updates to sensitive device identifier disclosures (IMSI, IMEI, unciphered SUCI).
+      * See {@link CellularIdentifierDisclosedListener#onCellularIdentifierDisclosedChanged}
+      *
+      * @hide
+      */
+    @FlaggedApi(Flags.FLAG_CELLULAR_IDENTIFIER_DISCLOSURE_INDICATIONS)
+    @RequiresPermission(android.Manifest.permission.READ_PRIVILEGED_PHONE_STATE)
+    @SystemApi
+    public static final int EVENT_CELLULAR_IDENTIFIER_DISCLOSED_CHANGED = 47;
+
+    /**
      * @hide
      */
     @IntDef(prefix = {"EVENT_"}, value = {
@@ -752,7 +774,9 @@ public class TelephonyCallback {
             EVENT_CARRIER_ROAMING_NTN_MODE_CHANGED,
             EVENT_CARRIER_ROAMING_NTN_ELIGIBLE_STATE_CHANGED,
             EVENT_CARRIER_ROAMING_NTN_AVAILABLE_SERVICES_CHANGED,
-            EVENT_CARRIER_ROAMING_NTN_SIGNAL_STRENGTH_CHANGED
+            EVENT_CARRIER_ROAMING_NTN_SIGNAL_STRENGTH_CHANGED,
+            EVENT_SECURITY_ALGORITHMS_CHANGED,
+            EVENT_CELLULAR_IDENTIFIER_DISCLOSED_CHANGED
     })
     @Retention(RetentionPolicy.SOURCE)
     public @interface TelephonyEvent {
@@ -1827,6 +1851,41 @@ public class TelephonyCallback {
     }
 
     /**
+     * Interface for CellularIdentifierDisclosedListener
+     * @hide
+     */
+    @SystemApi
+    @FlaggedApi(Flags.FLAG_CELLULAR_IDENTIFIER_DISCLOSURE_INDICATIONS)
+    public interface CellularIdentifierDisclosedListener {
+        /**
+         * Callback invoked when a device identifier (IMSI, IMEI, or unciphered SUCI)
+         * is disclosed over the network before a security context is established
+         * ("pre-authentication").
+         *
+         * @param disclosure details of the identifier disclosure
+         * See {@link CellularIdentifierDisclosure} for more details
+         */
+        void onCellularIdentifierDisclosedChanged(@NonNull CellularIdentifierDisclosure disclosure);
+    }
+
+    /**
+     * Interface for SecurityAlgorithmsListener
+     * @hide
+     */
+    @SystemApi
+    @FlaggedApi(Flags.FLAG_SECURITY_ALGORITHMS_UPDATE_INDICATIONS)
+    public interface SecurityAlgorithmsListener {
+        /**
+         * Callback invoked when the most recently reported security algorithms has changed,
+         * per a specified connection event.
+         *
+         * @param securityAlgorithmUpdate details of the security algorithm update
+         * See {@link SecurityAlgorithmUpdate} for more details
+         */
+        void onSecurityAlgorithmsChanged(@NonNull SecurityAlgorithmUpdate securityAlgorithmUpdate);
+    }
+
+    /**
      * The callback methods need to be called on the handler thread where
      * this object was created.  If the binder did that for us it'd be nice.
      * <p>
@@ -2302,5 +2361,27 @@ public class TelephonyCallback {
                     () -> listener.onCarrierRoamingNtnSignalStrengthChanged(ntnSignalStrength)));
 
         }
+
+        public void onSecurityAlgorithmsChanged(SecurityAlgorithmUpdate update) {
+            if (!Flags.securityAlgorithmsUpdateIndications()) return;
+
+            SecurityAlgorithmsListener listener =
+                    (SecurityAlgorithmsListener) mTelephonyCallbackWeakRef.get();
+            if (listener == null) return;
+
+            Binder.withCleanCallingIdentity(() -> mExecutor.execute(
+                    () -> listener.onSecurityAlgorithmsChanged(update)));
+        }
+
+        public void onCellularIdentifierDisclosedChanged(CellularIdentifierDisclosure disclosure) {
+            if (!Flags.cellularIdentifierDisclosureIndications()) return;
+
+            CellularIdentifierDisclosedListener listener =
+                    (CellularIdentifierDisclosedListener) mTelephonyCallbackWeakRef.get();
+            if (listener == null) return;
+
+            Binder.withCleanCallingIdentity(() -> mExecutor.execute(
+                    () -> listener.onCellularIdentifierDisclosedChanged(disclosure)));
+        }
     }
 }
diff --git a/core/java/android/telephony/TelephonyRegistryManager.java b/core/java/android/telephony/TelephonyRegistryManager.java
index 90b0bb34c145..4ec429d0c4ad 100644
--- a/core/java/android/telephony/TelephonyRegistryManager.java
+++ b/core/java/android/telephony/TelephonyRegistryManager.java
@@ -1154,6 +1154,40 @@ public class TelephonyRegistryManager {
         }
     }
 
+   /**
+     * Notify external listeners that the radio security algorithms have changed.
+     * @param slotIndex for the phone object that got updated
+     * @param subId for which the security algorithm changed
+     * @param update details of the security algorithm update
+     * @hide
+     */
+    public void notifySecurityAlgorithmsChanged(
+            int slotIndex, int subId, SecurityAlgorithmUpdate update) {
+        try {
+            sRegistry.notifySecurityAlgorithmsChanged(slotIndex, subId, update);
+        } catch (RemoteException ex) {
+            // system server crash
+            throw ex.rethrowFromSystemServer();
+        }
+    }
+
+    /**
+     * Notify external listeners of a new cellular identifier disclosure change.
+     * @param slotIndex for the phone object that the disclosure applies to
+     * @param subId for which the disclosure applies to
+     * @param disclosure details of the identifier disclosure
+     * @hide
+     */
+    public void notifyCellularIdentifierDisclosedChanged(
+            int slotIndex, int subId, CellularIdentifierDisclosure disclosure) {
+        try {
+            sRegistry.notifyCellularIdentifierDisclosedChanged(slotIndex, subId, disclosure);
+        } catch (RemoteException ex) {
+            // system server crash
+            throw ex.rethrowFromSystemServer();
+        }
+    }
+
     /**
      * Processes potential event changes from the provided {@link TelephonyCallback}.
      *
@@ -1313,6 +1347,15 @@ public class TelephonyRegistryManager {
             eventList.add(TelephonyCallback.EVENT_CARRIER_ROAMING_NTN_AVAILABLE_SERVICES_CHANGED);
             eventList.add(TelephonyCallback.EVENT_CARRIER_ROAMING_NTN_SIGNAL_STRENGTH_CHANGED);
         }
+
+        if (telephonyCallback instanceof TelephonyCallback.CellularIdentifierDisclosedListener) {
+            eventList.add(TelephonyCallback.EVENT_CELLULAR_IDENTIFIER_DISCLOSED_CHANGED);
+        }
+
+        if (telephonyCallback instanceof TelephonyCallback.SecurityAlgorithmsListener) {
+            eventList.add(TelephonyCallback.EVENT_SECURITY_ALGORITHMS_CHANGED);
+        }
+
         return eventList;
     }
 
diff --git a/core/java/com/android/internal/telephony/IPhoneStateListener.aidl b/core/java/com/android/internal/telephony/IPhoneStateListener.aidl
index 0e85e046e1b6..bf8a56508f54 100644
--- a/core/java/com/android/internal/telephony/IPhoneStateListener.aidl
+++ b/core/java/com/android/internal/telephony/IPhoneStateListener.aidl
@@ -20,6 +20,7 @@ import android.telephony.BarringInfo;
 import android.telephony.CallState;
 import android.telephony.CellIdentity;
 import android.telephony.CellInfo;
+import android.telephony.CellularIdentifierDisclosure;
 import android.telephony.DataConnectionRealTimeInfo;
 import android.telephony.LinkCapacityEstimate;
 import android.telephony.TelephonyDisplayInfo;
@@ -28,6 +29,7 @@ import android.telephony.PhysicalChannelConfig;
 import android.telephony.PreciseCallState;
 import android.telephony.PreciseDataConnectionState;
 import android.telephony.satellite.NtnSignalStrength;
+import android.telephony.SecurityAlgorithmUpdate;
 import android.telephony.ServiceState;
 import android.telephony.SignalStrength;
 import android.telephony.emergency.EmergencyNumber;
@@ -87,4 +89,6 @@ oneway interface IPhoneStateListener {
     void onCarrierRoamingNtnEligibleStateChanged(in boolean eligible);
     void onCarrierRoamingNtnAvailableServicesChanged(in int[] availableServices);
     void onCarrierRoamingNtnSignalStrengthChanged(in NtnSignalStrength ntnSignalStrength);
+    void onSecurityAlgorithmsChanged(in SecurityAlgorithmUpdate update);
+    void onCellularIdentifierDisclosedChanged(in CellularIdentifierDisclosure disclosure);
 }
diff --git a/core/java/com/android/internal/telephony/ITelephonyRegistry.aidl b/core/java/com/android/internal/telephony/ITelephonyRegistry.aidl
index 0f268d5de62b..a296fbd1cfe4 100644
--- a/core/java/com/android/internal/telephony/ITelephonyRegistry.aidl
+++ b/core/java/com/android/internal/telephony/ITelephonyRegistry.aidl
@@ -23,6 +23,7 @@ import android.telephony.BarringInfo;
 import android.telephony.CallQuality;
 import android.telephony.CellIdentity;
 import android.telephony.CellInfo;
+import android.telephony.CellularIdentifierDisclosure;
 import android.telephony.LinkCapacityEstimate;
 import android.telephony.TelephonyDisplayInfo;
 import android.telephony.ims.ImsReasonInfo;
@@ -30,6 +31,7 @@ import android.telephony.PhoneCapability;
 import android.telephony.PhysicalChannelConfig;
 import android.telephony.PreciseDataConnectionState;
 import android.telephony.satellite.NtnSignalStrength;
+import android.telephony.SecurityAlgorithmUpdate;
 import android.telephony.ServiceState;
 import android.telephony.SignalStrength;
 import android.telephony.emergency.EmergencyNumber;
@@ -132,4 +134,7 @@ interface ITelephonyRegistry {
     void removeSatelliteStateChangeListener(ISatelliteStateChangeListener listener, String pkg);
     void notifySatelliteStateChanged(boolean isEnabled);
 
+    void notifySecurityAlgorithmsChanged(int phoneId, int subId, in SecurityAlgorithmUpdate update);
+    void notifyCellularIdentifierDisclosedChanged(
+            int phoneId, int subId, in CellularIdentifierDisclosure disclosure);
 }
diff --git a/services/core/java/com/android/server/TelephonyRegistry.java b/services/core/java/com/android/server/TelephonyRegistry.java
index fa228627c255..e57b00944f7c 100644
--- a/services/core/java/com/android/server/TelephonyRegistry.java
+++ b/services/core/java/com/android/server/TelephonyRegistry.java
@@ -65,6 +65,7 @@ import android.telephony.CellSignalStrengthLte;
 import android.telephony.CellSignalStrengthNr;
 import android.telephony.CellSignalStrengthTdscdma;
 import android.telephony.CellSignalStrengthWcdma;
+import android.telephony.CellularIdentifierDisclosure;
 import android.telephony.DisconnectCause;
 import android.telephony.LinkCapacityEstimate;
 import android.telephony.LocationAccessPolicy;
@@ -76,6 +77,7 @@ import android.telephony.PreciseCallState;
 import android.telephony.PreciseDataConnectionState;
 import android.telephony.PreciseDisconnectCause;
 import android.telephony.Rlog;
+import android.telephony.SecurityAlgorithmUpdate;
 import android.telephony.ServiceState;
 import android.telephony.SignalStrength;
 import android.telephony.SubscriptionInfo;
@@ -590,7 +592,9 @@ public class TelephonyRegistry extends ITelephonyRegistry.Stub {
                 || events.contains(TelephonyCallback.EVENT_ALLOWED_NETWORK_TYPE_LIST_CHANGED)
                 || events.contains(TelephonyCallback.EVENT_EMERGENCY_CALLBACK_MODE_CHANGED)
                 || events.contains(TelephonyCallback
-                        .EVENT_SIMULTANEOUS_CELLULAR_CALLING_SUBSCRIPTIONS_CHANGED);
+                        .EVENT_SIMULTANEOUS_CELLULAR_CALLING_SUBSCRIPTIONS_CHANGED)
+                || events.contains(TelephonyCallback.EVENT_CELLULAR_IDENTIFIER_DISCLOSED_CHANGED)
+                || events.contains(TelephonyCallback.EVENT_SECURITY_ALGORITHMS_CHANGED);
     }
 
     private static final int MSG_USER_SWITCHED = 1;
@@ -897,7 +901,6 @@ public class TelephonyRegistry extends ITelephonyRegistry.Stub {
         mIsSatelliteEnabled = new AtomicBoolean();
         mWasSatelliteEnabledNotified = new AtomicBoolean();
 
-
         for (int i = 0; i < numPhones; i++) {
             mCallState[i] =  TelephonyManager.CALL_STATE_IDLE;
             mDataActivity[i] = TelephonyManager.DATA_ACTIVITY_NONE;
@@ -3825,7 +3828,6 @@ public class TelephonyRegistry extends ITelephonyRegistry.Stub {
         }
     }
 
-
     /**
      * Notify external listeners that carrier roaming non-terrestrial network
      * signal strength changed.
@@ -3835,7 +3837,7 @@ public class TelephonyRegistry extends ITelephonyRegistry.Stub {
     public void notifyCarrierRoamingNtnSignalStrengthChanged(int subId,
             @NonNull NtnSignalStrength ntnSignalStrength) {
         if (!checkNotifyPermission("notifyCarrierRoamingNtnSignalStrengthChanged")) {
-            log("nnotifyCarrierRoamingNtnSignalStrengthChanged: caller does not have required "
+            log("notifyCarrierRoamingNtnSignalStrengthChanged: caller does not have required "
                     + "permissions.");
             return;
         }
@@ -3863,6 +3865,98 @@ public class TelephonyRegistry extends ITelephonyRegistry.Stub {
         }
     }
 
+    /**
+     * Notify that the radio security algorithms have changed.
+     *
+     * @param phoneId the phone id.
+     * @param subId the subId.
+     * @param update the security algorithm update.
+     */
+    public void notifySecurityAlgorithmsChanged(int phoneId, int subId,
+            SecurityAlgorithmUpdate update) {
+        if (!Flags.securityAlgorithmsUpdateIndications()) {
+            log("Not available due to securityAlgorithmsUpdateIndications() flag");
+            return;
+        }
+        if (!checkNotifyPermission("notifySecurityAlgorithmChanged()")) {
+            return;
+        }
+
+        synchronized (mRecords) {
+            if (validatePhoneId(phoneId)) {
+                if (update == null) {
+                    loge("SecurityAlgorithmUpdate is null, subId=" + subId
+                            + ", phoneId=" + phoneId);
+                    // Listeners shouldn't be updated for null updates.
+                    return;
+                }
+
+                for (Record r : mRecords) {
+                    if (r.matchTelephonyCallbackEvent(
+                            TelephonyCallback.EVENT_SECURITY_ALGORITHMS_CHANGED)
+                            && idMatch(r, subId, phoneId)) {
+                        try {
+                            if (VDBG) {
+                                log("notifySecurityAlgorithmsChanged: securityAlgorithmUpdate= "
+                                        + update);
+                            }
+                            r.callback.onSecurityAlgorithmsChanged(update);
+                        } catch (RemoteException ex) {
+                            mRemoveList.add(r.binder);
+                        }
+                    }
+                }
+            }
+            handleRemoveListLocked();
+        }
+    }
+
+    /**
+     * Notify of a cellular identifier disclosure.
+     *
+     * @param phoneId the phone id.
+     * @param subId the subId.
+     * @param disclosure the cellular identifier disclosure.
+     */
+    public void notifyCellularIdentifierDisclosedChanged(int phoneId, int subId,
+            @NonNull CellularIdentifierDisclosure disclosure) {
+        if (!Flags.cellularIdentifierDisclosureIndications()) {
+            log("Not available due to cellularIdentifierDisclosureIndications() flag");
+            return;
+        }
+        if (!checkNotifyPermission("notifyCellularIdentifierDisclosedChanged()")) {
+            return;
+        }
+
+        synchronized (mRecords) {
+            if (validatePhoneId(phoneId)) {
+                if (disclosure == null) {
+                    loge("CellularIdentifierDisclosure is null, subId=" + subId
+                            + ", phoneId=" + phoneId);
+                    // Listeners shouldn't be updated for null disclosures.
+                    return;
+                }
+
+                for (Record r : mRecords) {
+                    if (r.matchTelephonyCallbackEvent(
+                            TelephonyCallback.EVENT_CELLULAR_IDENTIFIER_DISCLOSED_CHANGED)
+                            && idMatch(r, subId, phoneId)) {
+                        try {
+                            if (VDBG) {
+                                log("notifyCellularIdentifierDisclosedChanged: disclosure= "
+                                        + disclosure);
+                            }
+                            r.callback.onCellularIdentifierDisclosedChanged(disclosure);
+                        } catch (RemoteException ex) {
+                            mRemoveList.add(r.binder);
+                        }
+                    }
+                }
+            }
+            handleRemoveListLocked();
+        }
+    }
+
     @NeverCompile // Avoid size overhead of debugging code.
     @Override
     public void dump(FileDescriptor fd, PrintWriter writer, String[] args) {
diff --git a/telephony/java/android/telephony/CellularIdentifierDisclosure.aidl b/telephony/java/android/telephony/CellularIdentifierDisclosure.aidl
new file mode 100644
index 000000000000..1e41d6e2cc31
--- /dev/null
+++ b/telephony/java/android/telephony/CellularIdentifierDisclosure.aidl
@@ -0,0 +1,20 @@
+/*
+ * Copyright (C) 2023 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+/** @hide */
+package android.telephony;
+
+parcelable CellularIdentifierDisclosure;
diff --git a/telephony/java/android/telephony/CellularIdentifierDisclosure.java b/telephony/java/android/telephony/CellularIdentifierDisclosure.java
index 7b2db6d59819..0b6a70feac9d 100644
--- a/telephony/java/android/telephony/CellularIdentifierDisclosure.java
+++ b/telephony/java/android/telephony/CellularIdentifierDisclosure.java
@@ -16,11 +16,16 @@
 
 package android.telephony;
 
+import android.annotation.FlaggedApi;
 import android.annotation.IntDef;
 import android.annotation.NonNull;
+import android.annotation.SystemApi;
+import android.annotation.TestApi;
 import android.os.Parcel;
 import android.os.Parcelable;
 
+import com.android.internal.telephony.flags.Flags;
+
 import java.lang.annotation.Retention;
 import java.lang.annotation.RetentionPolicy;
 import java.util.Objects;
@@ -31,16 +36,88 @@ import java.util.Objects;
  *
  * @hide
  */
+@SystemApi
+@FlaggedApi(Flags.FLAG_CELLULAR_IDENTIFIER_DISCLOSURE_INDICATIONS)
 public final class CellularIdentifierDisclosure implements Parcelable {
     private static final String TAG = "CellularIdentifierDisclosure";
 
+    /* Non-access stratum protocol messages */
+    /** Unknown */
+    public static final int NAS_PROTOCOL_MESSAGE_UNKNOWN = 0;
+    /** ATTACH REQUESTS. Sample reference: TS 24.301 8.2.4 Applies to 2g, 3g, and 4g networks */
+    public static final int NAS_PROTOCOL_MESSAGE_ATTACH_REQUEST = 1;
+    /** IDENTITY RESPONSE. Sample Reference: TS 24.301 8.2.19.
+     * Applies to 2g, 3g, 4g, and 5g networks */
+    public static final int NAS_PROTOCOL_MESSAGE_IDENTITY_RESPONSE = 2;
+    /** DETACH_REQUEST. Sample Reference: TS 24.301 8.2.11. Applies to 2g, 3g, and 4g networks */
+    public static final int NAS_PROTOCOL_MESSAGE_DETACH_REQUEST = 3;
+    /** TRACKING AREA UPDATE (TAU) REQUEST. Sample Reference: 3GPP TS 24.301 8.2.29.
+     * Note: that per the spec, only temporary IDs should be sent in the TAU Request, but since the
+     * EPS Mobile Identity field supports IMSIs, this is included as an extra safety measure to
+     * combat implementation bugs. Applies to 4g and 5g networks. */
+    public static final int NAS_PROTOCOL_MESSAGE_TRACKING_AREA_UPDATE_REQUEST = 4;
+    /** LOCATION UPDATE REQUEST. Sample Reference: TS 24.008 4.4.3. Applies to 2g and 3g networks */
+    public static final int NAS_PROTOCOL_MESSAGE_LOCATION_UPDATE_REQUEST = 5;
+    /** AUTHENTICATION AND CIPHERING RESPONSE. Reference: 3GPP TS 24.008 4.7.7.1.
+     * Applies to 2g and 3g networks */
+    public static final int NAS_PROTOCOL_MESSAGE_AUTHENTICATION_AND_CIPHERING_RESPONSE = 6;
+    /** REGISTRATION REQUEST. Reference: 3GPP TS 24.501 8.2.6. Applies to 5g networks */
+    public static final int NAS_PROTOCOL_MESSAGE_REGISTRATION_REQUEST = 7;
+    /** DEREGISTRATION REQUEST. Reference: 3GPP TS 24.501 8.2.12. Applies to 5g networks */
+    public static final int NAS_PROTOCOL_MESSAGE_DEREGISTRATION_REQUEST = 8;
+    /** CONNECTION MANAGEMENT REESTABLISHMENT REQUEST. Reference: 3GPP TS 24.008 9.2.4.
+     * Applies to 2g and 3g networks */
+    public static final int NAS_PROTOCOL_MESSAGE_CM_REESTABLISHMENT_REQUEST = 9;
+    /** CONNECTION MANAGEMENT SERVICE REQUEST. Reference: 3GPP TS 24.008 9.2.9.
+     * Applies to 2g and 3g networks */
+    public static final int NAS_PROTOCOL_MESSAGE_CM_SERVICE_REQUEST = 10;
+    /** IMEI DETATCH INDICATION. Reference: 3GPP TS 24.008 9.2.14.
+     * Applies to 2g and 3g networks. Used for circuit-switched detach. */
+    public static final int NAS_PROTOCOL_MESSAGE_IMSI_DETACH_INDICATION = 11;
+
+    /** @hide */
+    @Retention(RetentionPolicy.SOURCE)
+    @IntDef(prefix = {"NAS_PROTOCOL_MESSAGE_"}, value = {NAS_PROTOCOL_MESSAGE_UNKNOWN,
+            NAS_PROTOCOL_MESSAGE_ATTACH_REQUEST, NAS_PROTOCOL_MESSAGE_IDENTITY_RESPONSE,
+            NAS_PROTOCOL_MESSAGE_DETACH_REQUEST, NAS_PROTOCOL_MESSAGE_TRACKING_AREA_UPDATE_REQUEST,
+            NAS_PROTOCOL_MESSAGE_LOCATION_UPDATE_REQUEST,
+            NAS_PROTOCOL_MESSAGE_AUTHENTICATION_AND_CIPHERING_RESPONSE,
+            NAS_PROTOCOL_MESSAGE_REGISTRATION_REQUEST, NAS_PROTOCOL_MESSAGE_DEREGISTRATION_REQUEST,
+            NAS_PROTOCOL_MESSAGE_CM_REESTABLISHMENT_REQUEST,
+            NAS_PROTOCOL_MESSAGE_CM_SERVICE_REQUEST, NAS_PROTOCOL_MESSAGE_IMSI_DETACH_INDICATION})
+    public @interface NasProtocolMessage {
+    }
+
+    /* Cellular identifiers */
+    /** Unknown */
+    public static final int CELLULAR_IDENTIFIER_UNKNOWN = 0;
+    /** IMSI (International Mobile Subscriber Identity) */
+    public static final int CELLULAR_IDENTIFIER_IMSI = 1;
+    /** IMEI (International Mobile Equipment Identity) */
+    public static final int CELLULAR_IDENTIFIER_IMEI = 2;
+    /** 5G-specific SUCI (Subscription Concealed Identifier) */
+    public static final int CELLULAR_IDENTIFIER_SUCI = 3;
+
+    /** @hide */
+    @Retention(RetentionPolicy.SOURCE)
+    @IntDef(prefix = {"CELLULAR_IDENTIFIER_"}, value = {CELLULAR_IDENTIFIER_UNKNOWN,
+            CELLULAR_IDENTIFIER_IMSI, CELLULAR_IDENTIFIER_IMEI, CELLULAR_IDENTIFIER_SUCI})
+    public @interface CellularIdentifier {
+    }
+
     private @NasProtocolMessage int mNasProtocolMessage;
     private @CellularIdentifier int mCellularIdentifier;
     private String mPlmn;
     private boolean mIsEmergency;
 
+    /**
+     * Constructor for new CellularIdentifierDisclosure instances.
+     *
+     * @hide
+     */
+    @TestApi
     public CellularIdentifierDisclosure(@NasProtocolMessage int nasProtocolMessage,
-            @CellularIdentifier int cellularIdentifier, String plmn, boolean isEmergency) {
+            @CellularIdentifier int cellularIdentifier, @NonNull String plmn, boolean isEmergency) {
         mNasProtocolMessage = nasProtocolMessage;
         mCellularIdentifier = cellularIdentifier;
         mPlmn = plmn;
@@ -51,18 +128,30 @@ public final class CellularIdentifierDisclosure implements Parcelable {
         readFromParcel(in);
     }
 
+    /**
+     * @return the NAS protocol message associated with the disclosed identifier.
+     */
     public @NasProtocolMessage int getNasProtocolMessage() {
         return mNasProtocolMessage;
     }
 
+    /**
+     * @return the identifier disclosed.
+     */
     public @CellularIdentifier int getCellularIdentifier() {
         return mCellularIdentifier;
     }
 
-    public String getPlmn() {
+    /**
+     * @return the PLMN associated with the disclosure.
+     */
+    @NonNull public String getPlmn() {
         return mPlmn;
     }
 
+    /**
+     * @return if the disclosure is associated with an emergency call.
+     */
     public boolean isEmergency() {
         return mIsEmergency;
     }
@@ -73,14 +162,14 @@ public final class CellularIdentifierDisclosure implements Parcelable {
     }
 
     @Override
-    public void writeToParcel(Parcel out, int flags) {
+    public void writeToParcel(@NonNull Parcel out, int flags) {
         out.writeInt(mNasProtocolMessage);
         out.writeInt(mCellularIdentifier);
         out.writeBoolean(mIsEmergency);
         out.writeString8(mPlmn);
     }
 
-    public static final Parcelable.Creator<CellularIdentifierDisclosure> CREATOR =
+    public static final @NonNull Parcelable.Creator<CellularIdentifierDisclosure> CREATOR =
             new Parcelable.Creator<CellularIdentifierDisclosure>() {
                 public CellularIdentifierDisclosure createFromParcel(Parcel in) {
                     return new CellularIdentifierDisclosure(in);
@@ -120,42 +209,4 @@ public final class CellularIdentifierDisclosure implements Parcelable {
         mIsEmergency = in.readBoolean();
         mPlmn = in.readString8();
     }
-
-    public static final int NAS_PROTOCOL_MESSAGE_UNKNOWN = 0;
-    public static final int NAS_PROTOCOL_MESSAGE_ATTACH_REQUEST = 1;
-    public static final int NAS_PROTOCOL_MESSAGE_IDENTITY_RESPONSE = 2;
-    public static final int NAS_PROTOCOL_MESSAGE_DETACH_REQUEST = 3;
-    public static final int NAS_PROTOCOL_MESSAGE_TRACKING_AREA_UPDATE_REQUEST = 4;
-    public static final int NAS_PROTOCOL_MESSAGE_LOCATION_UPDATE_REQUEST = 5;
-    public static final int NAS_PROTOCOL_MESSAGE_AUTHENTICATION_AND_CIPHERING_RESPONSE = 6;
-    public static final int NAS_PROTOCOL_MESSAGE_REGISTRATION_REQUEST = 7;
-    public static final int NAS_PROTOCOL_MESSAGE_DEREGISTRATION_REQUEST = 8;
-    public static final int NAS_PROTOCOL_MESSAGE_CM_REESTABLISHMENT_REQUEST = 9;
-    public static final int NAS_PROTOCOL_MESSAGE_CM_SERVICE_REQUEST = 10;
-    public static final int NAS_PROTOCOL_MESSAGE_IMSI_DETACH_INDICATION = 11;
-
-    /** @hide */
-    @Retention(RetentionPolicy.SOURCE)
-    @IntDef(prefix = {"NAS_PROTOCOL_MESSAGE_"}, value = {NAS_PROTOCOL_MESSAGE_UNKNOWN,
-            NAS_PROTOCOL_MESSAGE_ATTACH_REQUEST, NAS_PROTOCOL_MESSAGE_IDENTITY_RESPONSE,
-            NAS_PROTOCOL_MESSAGE_DETACH_REQUEST, NAS_PROTOCOL_MESSAGE_TRACKING_AREA_UPDATE_REQUEST,
-            NAS_PROTOCOL_MESSAGE_LOCATION_UPDATE_REQUEST,
-            NAS_PROTOCOL_MESSAGE_AUTHENTICATION_AND_CIPHERING_RESPONSE,
-            NAS_PROTOCOL_MESSAGE_REGISTRATION_REQUEST, NAS_PROTOCOL_MESSAGE_DEREGISTRATION_REQUEST,
-            NAS_PROTOCOL_MESSAGE_CM_REESTABLISHMENT_REQUEST,
-            NAS_PROTOCOL_MESSAGE_CM_SERVICE_REQUEST, NAS_PROTOCOL_MESSAGE_IMSI_DETACH_INDICATION})
-    public @interface NasProtocolMessage {
-    }
-
-    public static final int CELLULAR_IDENTIFIER_UNKNOWN = 0;
-    public static final int CELLULAR_IDENTIFIER_IMSI = 1;
-    public static final int CELLULAR_IDENTIFIER_IMEI = 2;
-    public static final int CELLULAR_IDENTIFIER_SUCI = 3;
-
-    /** @hide */
-    @Retention(RetentionPolicy.SOURCE)
-    @IntDef(prefix = {"CELLULAR_IDENTIFIER_"}, value = {CELLULAR_IDENTIFIER_UNKNOWN,
-            CELLULAR_IDENTIFIER_IMSI, CELLULAR_IDENTIFIER_IMEI, CELLULAR_IDENTIFIER_SUCI})
-    public @interface CellularIdentifier {
-    }
 }
diff --git a/telephony/java/android/telephony/SecurityAlgorithmUpdate.aidl b/telephony/java/android/telephony/SecurityAlgorithmUpdate.aidl
new file mode 100644
index 000000000000..bee30bd43df9
--- /dev/null
+++ b/telephony/java/android/telephony/SecurityAlgorithmUpdate.aidl
@@ -0,0 +1,20 @@
+/*
+ * Copyright (C) 2024 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+/** @hide */
+package android.telephony;
+
+parcelable SecurityAlgorithmUpdate;
diff --git a/telephony/java/android/telephony/SecurityAlgorithmUpdate.java b/telephony/java/android/telephony/SecurityAlgorithmUpdate.java
index 57209eb68de8..d635b555276b 100644
--- a/telephony/java/android/telephony/SecurityAlgorithmUpdate.java
+++ b/telephony/java/android/telephony/SecurityAlgorithmUpdate.java
@@ -16,11 +16,16 @@
 
 package android.telephony;
 
+import android.annotation.FlaggedApi;
 import android.annotation.IntDef;
 import android.annotation.NonNull;
+import android.annotation.SystemApi;
+import android.annotation.TestApi;
 import android.os.Parcel;
 import android.os.Parcelable;
 
+import com.android.internal.telephony.flags.Flags;
+
 import java.lang.annotation.Retention;
 import java.lang.annotation.RetentionPolicy;
 import java.util.Objects;
@@ -31,112 +36,42 @@ import java.util.Objects;
  *
  * @hide
  */
+@SystemApi
+@FlaggedApi(Flags.FLAG_SECURITY_ALGORITHMS_UPDATE_INDICATIONS)
 public final class SecurityAlgorithmUpdate implements Parcelable {
     private static final String TAG = "SecurityAlgorithmUpdate";
 
-    private @ConnectionEvent int mConnectionEvent;
-    private @SecurityAlgorithm int mEncryption;
-    private @SecurityAlgorithm int mIntegrity;
-    private boolean mIsUnprotectedEmergency;
-
-    public SecurityAlgorithmUpdate(@ConnectionEvent int connectionEvent,
-            @SecurityAlgorithm int encryption, @SecurityAlgorithm int integrity,
-            boolean isUnprotectedEmergency) {
-        mConnectionEvent = connectionEvent;
-        mEncryption = encryption;
-        mIntegrity = integrity;
-        mIsUnprotectedEmergency = isUnprotectedEmergency;
-    }
-
-    private SecurityAlgorithmUpdate(Parcel in) {
-        readFromParcel(in);
-    }
-
-    public @ConnectionEvent int getConnectionEvent() {
-        return mConnectionEvent;
-    }
-
-    public @SecurityAlgorithm int getEncryption() {
-        return mEncryption;
-    }
-
-    public @SecurityAlgorithm int getIntegrity() {
-        return mIntegrity;
-    }
-
-    public boolean isUnprotectedEmergency() {
-        return mIsUnprotectedEmergency;
-    }
-
-    @Override
-    public int describeContents() {
-        return 0;
-    }
-
-    @Override
-    public void writeToParcel(Parcel out, int flags) {
-        out.writeInt(mConnectionEvent);
-        out.writeInt(mEncryption);
-        out.writeInt(mIntegrity);
-        out.writeBoolean(mIsUnprotectedEmergency);
-    }
-
-    private void readFromParcel(@NonNull Parcel in) {
-        mConnectionEvent = in.readInt();
-        mEncryption = in.readInt();
-        mIntegrity = in.readInt();
-        mIsUnprotectedEmergency = in.readBoolean();
-    }
-
-    public static final Parcelable.Creator<SecurityAlgorithmUpdate> CREATOR =
-            new Parcelable.Creator<SecurityAlgorithmUpdate>() {
-                public SecurityAlgorithmUpdate createFromParcel(Parcel in) {
-                    return new SecurityAlgorithmUpdate(in);
-                }
-
-                public SecurityAlgorithmUpdate[] newArray(int size) {
-                    return new SecurityAlgorithmUpdate[size];
-                }
-            };
-
-    @Override
-    public String toString() {
-        return TAG + ":{ mConnectionEvent = " + mConnectionEvent + " mEncryption = " + mEncryption
-                + " mIntegrity = " + mIntegrity + " mIsUnprotectedEmergency = "
-                + mIsUnprotectedEmergency;
-    }
-
-    @Override
-    public boolean equals(Object o) {
-        if (this == o) return true;
-        if (!(o instanceof SecurityAlgorithmUpdate)) return false;
-        SecurityAlgorithmUpdate that = (SecurityAlgorithmUpdate) o;
-        return mConnectionEvent == that.mConnectionEvent
-                && mEncryption == that.mEncryption
-                && mIntegrity == that.mIntegrity
-                && mIsUnprotectedEmergency == that.mIsUnprotectedEmergency;
-    }
-
-    @Override
-    public int hashCode() {
-        return Objects.hash(mConnectionEvent, mEncryption, mIntegrity, mIsUnprotectedEmergency);
-    }
-
+    /** 2G GSM circuit switched */
     public static final int CONNECTION_EVENT_CS_SIGNALLING_GSM = 0;
+    /** 2G GPRS packet services */
     public static final int CONNECTION_EVENT_PS_SIGNALLING_GPRS = 1;
+    /** 3G circuit switched*/
     public static final int CONNECTION_EVENT_CS_SIGNALLING_3G = 2;
+    /** 3G packet switched*/
     public static final int CONNECTION_EVENT_PS_SIGNALLING_3G = 3;
+    /** 4G Non-access stratum */
     public static final int CONNECTION_EVENT_NAS_SIGNALLING_LTE = 4;
+    /** 4G Access-stratum */
     public static final int CONNECTION_EVENT_AS_SIGNALLING_LTE = 5;
+    /** VOLTE SIP */
     public static final int CONNECTION_EVENT_VOLTE_SIP = 6;
+    /** VOLTE SIP SOS (emergency) */
     public static final int CONNECTION_EVENT_VOLTE_SIP_SOS = 7;
+    /** VOLTE RTP */
     public static final int CONNECTION_EVENT_VOLTE_RTP = 8;
+    /** VOLTE RTP SOS (emergency) */
     public static final int CONNECTION_EVENT_VOLTE_RTP_SOS = 9;
+    /** 5G Non-access stratum */
     public static final int CONNECTION_EVENT_NAS_SIGNALLING_5G = 10;
+    /** 5G Access stratum */
     public static final int CONNECTION_EVENT_AS_SIGNALLING_5G = 11;
+    /** VoNR SIP */
     public static final int CONNECTION_EVENT_VONR_SIP = 12;
+    /** VoNR SIP SOS (emergency) */
     public static final int CONNECTION_EVENT_VONR_SIP_SOS = 13;
+    /** VoNR RTP */
     public static final int CONNECTION_EVENT_VONR_RTP = 14;
+    /** VoNR RTP SOS (emergency) */
     public static final int CONNECTION_EVENT_VONR_RTP_SOS = 15;
 
     /** @hide */
@@ -153,48 +88,101 @@ public final class SecurityAlgorithmUpdate implements Parcelable {
     public @interface ConnectionEvent {
     }
 
+    /* GSM CS services, see 3GPP TS 43.020 for details */
+    /** A5/0 - the null cipher */
     public static final int SECURITY_ALGORITHM_A50 = 0;
+    /** A5/1 cipher */
     public static final int SECURITY_ALGORITHM_A51 = 1;
+    /** A5/2 cipher */
     public static final int SECURITY_ALGORITHM_A52 = 2;
+    /** A5/3 cipher */
     public static final int SECURITY_ALGORITHM_A53 = 3;
+    /** A5/4 cipher */
     public static final int SECURITY_ALGORITHM_A54 = 4;
+    /* GPRS PS services (3GPP TS 43.020) */
+    /** GEA0 - null cipher */
     public static final int SECURITY_ALGORITHM_GEA0 = 14;
+    /** GEA1 cipher */
     public static final int SECURITY_ALGORITHM_GEA1 = 15;
+    /** GEA2 cipher */
     public static final int SECURITY_ALGORITHM_GEA2 = 16;
+    /** GEA3 cipher */
     public static final int SECURITY_ALGORITHM_GEA3 = 17;
+    /** GEA4 cipher */
     public static final int SECURITY_ALGORITHM_GEA4 = 18;
+    /** GEA5 cipher */
     public static final int SECURITY_ALGORITHM_GEA5 = 19;
+    /* 3G PS/CS services (3GPP TS 33.102) */
+    /** UEA0 - null cipher */
     public static final int SECURITY_ALGORITHM_UEA0 = 29;
+    /** UEA1 cipher */
     public static final int SECURITY_ALGORITHM_UEA1 = 30;
+    /** UEA2 cipher */
     public static final int SECURITY_ALGORITHM_UEA2 = 31;
+    /* 4G PS services & 5G NSA (3GPP TS 33.401) */
+    /** EEA0 - null cipher */
     public static final int SECURITY_ALGORITHM_EEA0 = 41;
+    /** EEA1 */
     public static final int SECURITY_ALGORITHM_EEA1 = 42;
+    /** EEA2 */
     public static final int SECURITY_ALGORITHM_EEA2 = 43;
+    /** EEA3 */
     public static final int SECURITY_ALGORITHM_EEA3 = 44;
+    /* 5G PS services (3GPP TS 33.401 for 5G NSA and 3GPP TS 33.501 for 5G SA) */
+    /** NEA0 - the null cipher */
     public static final int SECURITY_ALGORITHM_NEA0 = 55;
+    /** NEA1 */
     public static final int SECURITY_ALGORITHM_NEA1 = 56;
+    /** NEA2 */
     public static final int SECURITY_ALGORITHM_NEA2 = 57;
+    /** NEA3 */
     public static final int SECURITY_ALGORITHM_NEA3 = 58;
+    /* IMS and SIP layer security (See 3GPP TS 33.203) */
+    /** No IPsec config */
     public static final int SECURITY_ALGORITHM_SIP_NO_IPSEC_CONFIG = 66;
+    /** No IMS security, recommended to use SIP_NO_IPSEC_CONFIG and SIP_NULL instead */
     public static final int SECURITY_ALGORITHM_IMS_NULL = 67;
+    /* IPSEC is present */
+    /** SIP security is not enabled */
     public static final int SECURITY_ALGORITHM_SIP_NULL = 68;
+    /** AES GCM mode */
     public static final int SECURITY_ALGORITHM_AES_GCM = 69;
+    /** AES GMAC mode */
     public static final int SECURITY_ALGORITHM_AES_GMAC = 70;
+    /** AES CBC mode */
     public static final int SECURITY_ALGORITHM_AES_CBC = 71;
+    /** DES EDE3 CBC mode */
     public static final int SECURITY_ALGORITHM_DES_EDE3_CBC = 72;
+    /** AES EDE3 CBC mode */
     public static final int SECURITY_ALGORITHM_AES_EDE3_CBC = 73;
+    /** HMAC SHA1 96 */
     public static final int SECURITY_ALGORITHM_HMAC_SHA1_96 = 74;
+    /** HMAC MD5 96 */
     public static final int SECURITY_ALGORITHM_HMAC_MD5_96 = 75;
+    /* RTP and SRTP (see 3GPP TS 33.328) */
+    /** RTP only, SRTP is not being used */
     public static final int SECURITY_ALGORITHM_RTP = 85;
+    /* When SRTP is available and used */
+    /** SRTP with null ciphering */
     public static final int SECURITY_ALGORITHM_SRTP_NULL = 86;
+    /** SRTP with AES counter mode */
     public static final int SECURITY_ALGORITHM_SRTP_AES_COUNTER = 87;
+    /** SRTP with AES F8 mode */
     public static final int SECURITY_ALGORITHM_SRTP_AES_F8 = 88;
+    /** SRTP with HMAC SHA1 */
     public static final int SECURITY_ALGORITHM_SRTP_HMAC_SHA1 = 89;
+    /* Ciphers for ePDG (3GPP TS 33.402) */
+    /** ePDG encryption - AES GCM mode */
     public static final int SECURITY_ALGORITHM_ENCR_AES_GCM_16 = 99;
+    /** ePDG encryption - AES GCM CBC mode */
     public static final int SECURITY_ALGORITHM_ENCR_AES_CBC = 100;
+    /** ePDG authentication - HMAC SHA1 256 128 */
     public static final int SECURITY_ALGORITHM_AUTH_HMAC_SHA2_256_128 = 101;
+    /** Unknown */
     public static final int SECURITY_ALGORITHM_UNKNOWN = 113;
+    /** Other */
     public static final int SECURITY_ALGORITHM_OTHER = 114;
+    /** Proprietary algorithms */
     public static final int SECURITY_ALGORITHM_ORYX = 124;
 
     /** @hide */
@@ -220,4 +208,109 @@ public final class SecurityAlgorithmUpdate implements Parcelable {
     public @interface SecurityAlgorithm {
     }
 
+    private @ConnectionEvent int mConnectionEvent;
+    private @SecurityAlgorithm int mEncryption;
+    private @SecurityAlgorithm int mIntegrity;
+    private boolean mIsUnprotectedEmergency;
+
+    /**
+     * Constructor for new SecurityAlgorithmUpdate instances.
+     *
+     * @hide
+     */
+    @TestApi
+    public SecurityAlgorithmUpdate(@ConnectionEvent int connectionEvent,
+            @SecurityAlgorithm int encryption, @SecurityAlgorithm int integrity,
+            boolean isUnprotectedEmergency) {
+        mConnectionEvent = connectionEvent;
+        mEncryption = encryption;
+        mIntegrity = integrity;
+        mIsUnprotectedEmergency = isUnprotectedEmergency;
+    }
+
+    private SecurityAlgorithmUpdate(Parcel in) {
+        readFromParcel(in);
+    }
+
+    /**
+     * @return the connection event.
+     */
+    public @ConnectionEvent int getConnectionEvent() {
+        return mConnectionEvent;
+    }
+
+    /**
+     * @return the encryption algorithm.
+     */
+    public @SecurityAlgorithm int getEncryption() {
+        return mEncryption;
+    }
+
+    /**
+     * @return the integrity algorithm.
+     */
+    public @SecurityAlgorithm int getIntegrity() {
+        return mIntegrity;
+    }
+
+    /**
+     * @return if the security algorithm update is associated with an unprotected emergency call.
+     */
+    public boolean isUnprotectedEmergency() {
+        return mIsUnprotectedEmergency;
+    }
+
+    @Override
+    public int describeContents() {
+        return 0;
+    }
+
+    @Override
+    public void writeToParcel(@NonNull Parcel out, int flags) {
+        out.writeInt(mConnectionEvent);
+        out.writeInt(mEncryption);
+        out.writeInt(mIntegrity);
+        out.writeBoolean(mIsUnprotectedEmergency);
+    }
+
+    private void readFromParcel(@NonNull Parcel in) {
+        mConnectionEvent = in.readInt();
+        mEncryption = in.readInt();
+        mIntegrity = in.readInt();
+        mIsUnprotectedEmergency = in.readBoolean();
+    }
+
+    public static final @NonNull Parcelable.Creator<SecurityAlgorithmUpdate> CREATOR =
+            new Parcelable.Creator<SecurityAlgorithmUpdate>() {
+                public SecurityAlgorithmUpdate createFromParcel(Parcel in) {
+                    return new SecurityAlgorithmUpdate(in);
+                }
+
+                public SecurityAlgorithmUpdate[] newArray(int size) {
+                    return new SecurityAlgorithmUpdate[size];
+                }
+            };
+
+    @Override
+    public String toString() {
+        return TAG + ":{ mConnectionEvent = " + mConnectionEvent + " mEncryption = " + mEncryption
+                + " mIntegrity = " + mIntegrity + " mIsUnprotectedEmergency = "
+                + mIsUnprotectedEmergency;
+    }
+
+    @Override
+    public boolean equals(Object o) {
+        if (this == o) return true;
+        if (!(o instanceof SecurityAlgorithmUpdate)) return false;
+        SecurityAlgorithmUpdate that = (SecurityAlgorithmUpdate) o;
+        return mConnectionEvent == that.mConnectionEvent
+                && mEncryption == that.mEncryption
+                && mIntegrity == that.mIntegrity
+                && mIsUnprotectedEmergency == that.mIsUnprotectedEmergency;
+    }
+
+    @Override
+    public int hashCode() {
+        return Objects.hash(mConnectionEvent, mEncryption, mIntegrity, mIsUnprotectedEmergency);
+    }
 }