1 /*
2  * Copyright 2017 The Android Open Source Project
3  *
4  * Licensed under the Apache License, Version 2.0 (the "License");
5  * you may not use this file except in compliance with the License.
6  * You may obtain a copy of the License at
7  *
8  *      http://www.apache.org/licenses/LICENSE-2.0
9  *
10  * Unless required by applicable law or agreed to in writing, software
11  * distributed under the License is distributed on an "AS IS" BASIS,
12  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13  * See the License for the specific language governing permissions and
14  * limitations under the License.
15  */
16 
17 package com.android.server.net.watchlist;
18 
19 import android.privacy.DifferentialPrivacyEncoder;
20 import android.privacy.internal.longitudinalreporting.LongitudinalReportingConfig;
21 import android.privacy.internal.longitudinalreporting.LongitudinalReportingEncoder;
22 import android.util.Slog;
23 
24 import com.android.internal.annotations.VisibleForTesting;
25 
26 import java.util.HashMap;
27 import java.util.List;
28 import java.util.Map;
29 
30 /**
31  * Helper class to apply differential privacy to watchlist reports.
32  */
33 class PrivacyUtils {
34 
35     private static final String TAG = "PrivacyUtils";
36     private static final boolean DEBUG = NetworkWatchlistService.DEBUG;
37 
38     /**
39      * Parameters used for encoding watchlist reports.
40      * These numbers are optimal parameters for protecting privacy with good utility.
41      *
42      * TODO: Add links to explain the math behind.
43      */
44     private static final String ENCODER_ID_PREFIX = "watchlist_encoder:";
45     private static final double PROB_F = 0.469;
46     private static final double PROB_P = 0.28;
47     private static final double PROB_Q = 1.0;
48 
PrivacyUtils()49     private PrivacyUtils() {
50     }
51 
52     /**
53      * Get insecure DP encoder.
54      * Should not apply it directly on real data as seed is not randomized.
55      */
56     @VisibleForTesting
createInsecureDPEncoderForTest(String appDigest)57     static DifferentialPrivacyEncoder createInsecureDPEncoderForTest(String appDigest) {
58         final LongitudinalReportingConfig config = createLongitudinalReportingConfig(appDigest);
59         return LongitudinalReportingEncoder.createInsecureEncoderForTest(config);
60     }
61 
62     /**
63      * Get secure encoder to encode watchlist.
64      *
65      * Warning: If you use the same user secret and app digest, then you will get the same
66      * PRR result.
67      */
68     @VisibleForTesting
createSecureDPEncoder(byte[] userSecret, String appDigest)69     static DifferentialPrivacyEncoder createSecureDPEncoder(byte[] userSecret,
70             String appDigest) {
71         final LongitudinalReportingConfig config = createLongitudinalReportingConfig(appDigest);
72         return LongitudinalReportingEncoder.createEncoder(config, userSecret);
73     }
74 
75     /**
76      * Get DP config for encoding watchlist reports.
77      */
createLongitudinalReportingConfig(String appDigest)78     private static LongitudinalReportingConfig createLongitudinalReportingConfig(String appDigest) {
79         return new LongitudinalReportingConfig(ENCODER_ID_PREFIX + appDigest, PROB_F, PROB_P,
80                 PROB_Q);
81     }
82 
83     /**
84      * Create a map that stores appDigest, encoded_visitedWatchlist pairs.
85      */
86     @VisibleForTesting
createDpEncodedReportMap(boolean isSecure, byte[] userSecret, List<String> appDigestList, WatchlistReportDbHelper.AggregatedResult aggregatedResult)87     static Map<String, Boolean> createDpEncodedReportMap(boolean isSecure, byte[] userSecret,
88             List<String> appDigestList, WatchlistReportDbHelper.AggregatedResult aggregatedResult) {
89         if (DEBUG) Slog.i(TAG, "createDpEncodedReportMap start");
90         final int appDigestListSize = appDigestList.size();
91         final HashMap<String, Boolean> resultMap = new HashMap<>(appDigestListSize);
92         for (int i = 0; i < appDigestListSize; i++) {
93             final String appDigest = appDigestList.get(i);
94             // Each app needs to have different PRR result, hence we use appDigest as encoder Id.
95             final DifferentialPrivacyEncoder encoder = isSecure
96                     ? createSecureDPEncoder(userSecret, appDigest)
97                     : createInsecureDPEncoderForTest(appDigest);
98             final boolean visitedWatchlist = aggregatedResult.appDigestList.contains(appDigest);
99             if (DEBUG) Slog.i(TAG, appDigest + ": " + visitedWatchlist);
100             // Get the least significant bit of first byte, and set result to True if it is 1
101             boolean encodedVisitedWatchlist = ((int) encoder.encodeBoolean(visitedWatchlist)[0]
102                     & 0x1) == 0x1;
103             resultMap.put(appDigest, encodedVisitedWatchlist);
104         }
105         return resultMap;
106     }
107 }
108