diff --git a/api/current.txt b/api/current.txt
index ed94018ed5143..1a9d32214fb1a 100644
--- a/api/current.txt
+++ b/api/current.txt
@@ -34268,8 +34268,13 @@ package android.security {
     method public static java.security.PrivateKey getPrivateKey(android.content.Context, java.lang.String) throws java.lang.InterruptedException, android.security.KeyChainException;
     method public static deprecated boolean isBoundKeyAlgorithm(java.lang.String);
     method public static boolean isKeyAlgorithmSupported(java.lang.String);
-    field public static final java.lang.String ACTION_STORAGE_CHANGED = "android.security.STORAGE_CHANGED";
+    field public static final java.lang.String ACTION_KEYCHAIN_CHANGED = "android.security.action.KEYCHAIN_CHANGED";
+    field public static final java.lang.String ACTION_KEY_ACCESS_CHANGED = "android.security.action.KEY_ACCESS_CHANGED";
+    field public static final deprecated java.lang.String ACTION_STORAGE_CHANGED = "android.security.STORAGE_CHANGED";
+    field public static final java.lang.String ACTION_TRUST_STORE_CHANGED = "android.security.action.TRUST_STORE_CHANGED";
     field public static final java.lang.String EXTRA_CERTIFICATE = "CERT";
+    field public static final java.lang.String EXTRA_KEY_ACCESSIBLE = "android.security.extra.KEY_ACCESSIBLE";
+    field public static final java.lang.String EXTRA_KEY_ALIAS = "android.security.extra.KEY_ALIAS";
     field public static final java.lang.String EXTRA_NAME = "name";
     field public static final java.lang.String EXTRA_PKCS12 = "PKCS12";
   }
diff --git a/api/system-current.txt b/api/system-current.txt
index 8d4186f6846c1..c9a280aa4739a 100644
--- a/api/system-current.txt
+++ b/api/system-current.txt
@@ -36976,8 +36976,13 @@ package android.security {
     method public static java.security.PrivateKey getPrivateKey(android.content.Context, java.lang.String) throws java.lang.InterruptedException, android.security.KeyChainException;
     method public static deprecated boolean isBoundKeyAlgorithm(java.lang.String);
     method public static boolean isKeyAlgorithmSupported(java.lang.String);
-    field public static final java.lang.String ACTION_STORAGE_CHANGED = "android.security.STORAGE_CHANGED";
+    field public static final java.lang.String ACTION_KEYCHAIN_CHANGED = "android.security.action.KEYCHAIN_CHANGED";
+    field public static final java.lang.String ACTION_KEY_ACCESS_CHANGED = "android.security.action.KEY_ACCESS_CHANGED";
+    field public static final deprecated java.lang.String ACTION_STORAGE_CHANGED = "android.security.STORAGE_CHANGED";
+    field public static final java.lang.String ACTION_TRUST_STORE_CHANGED = "android.security.action.TRUST_STORE_CHANGED";
     field public static final java.lang.String EXTRA_CERTIFICATE = "CERT";
+    field public static final java.lang.String EXTRA_KEY_ACCESSIBLE = "android.security.extra.KEY_ACCESSIBLE";
+    field public static final java.lang.String EXTRA_KEY_ALIAS = "android.security.extra.KEY_ALIAS";
     field public static final java.lang.String EXTRA_NAME = "name";
     field public static final java.lang.String EXTRA_PKCS12 = "PKCS12";
   }
diff --git a/api/test-current.txt b/api/test-current.txt
index 847b53fe15a58..2ebe4907af23b 100644
--- a/api/test-current.txt
+++ b/api/test-current.txt
@@ -34345,8 +34345,13 @@ package android.security {
     method public static java.security.PrivateKey getPrivateKey(android.content.Context, java.lang.String) throws java.lang.InterruptedException, android.security.KeyChainException;
     method public static deprecated boolean isBoundKeyAlgorithm(java.lang.String);
     method public static boolean isKeyAlgorithmSupported(java.lang.String);
-    field public static final java.lang.String ACTION_STORAGE_CHANGED = "android.security.STORAGE_CHANGED";
+    field public static final java.lang.String ACTION_KEYCHAIN_CHANGED = "android.security.action.KEYCHAIN_CHANGED";
+    field public static final java.lang.String ACTION_KEY_ACCESS_CHANGED = "android.security.action.KEY_ACCESS_CHANGED";
+    field public static final deprecated java.lang.String ACTION_STORAGE_CHANGED = "android.security.STORAGE_CHANGED";
+    field public static final java.lang.String ACTION_TRUST_STORE_CHANGED = "android.security.action.TRUST_STORE_CHANGED";
     field public static final java.lang.String EXTRA_CERTIFICATE = "CERT";
+    field public static final java.lang.String EXTRA_KEY_ACCESSIBLE = "android.security.extra.KEY_ACCESSIBLE";
+    field public static final java.lang.String EXTRA_KEY_ALIAS = "android.security.extra.KEY_ALIAS";
     field public static final java.lang.String EXTRA_NAME = "name";
     field public static final java.lang.String EXTRA_PKCS12 = "PKCS12";
   }
diff --git a/core/res/AndroidManifest.xml b/core/res/AndroidManifest.xml
index 8750866b5c114..1a8ed42c1046b 100644
--- a/core/res/AndroidManifest.xml
+++ b/core/res/AndroidManifest.xml
@@ -404,6 +404,9 @@
     <protected-broadcast android:name="android.os.action.DISCHARGING" />
     <protected-broadcast android:name="android.search.action.SEARCHABLES_CHANGED" />
     <protected-broadcast android:name="android.security.STORAGE_CHANGED" />
+    <protected-broadcast android:name="android.security.action.TRUST_STORE_CHANGED" />
+    <protected-broadcast android:name="android.security.action.KEYCHAIN_CHANGED" />
+    <protected-broadcast android:name="android.security.action.KEY_PERMISSION_CHANGED" />
     <protected-broadcast android:name="android.telecom.action.PHONE_ACCOUNT_REGISTERED" />
     <protected-broadcast android:name="android.telecom.action.PHONE_ACCOUNT_UNREGISTERED" />
     <protected-broadcast android:name="android.telecom.action.SHOW_MISSED_CALLS_NOTIFICATION" />
diff --git a/keystore/java/android/security/KeyChain.java b/keystore/java/android/security/KeyChain.java
index cce58c2096f35..9481c462e41c9 100644
--- a/keystore/java/android/security/KeyChain.java
+++ b/keystore/java/android/security/KeyChain.java
@@ -179,7 +179,6 @@ public final class KeyChain {
     // Compatible with old android.security.Credentials.PKCS12
     public static final String EXTRA_PKCS12 = "PKCS12";
 
-
     /**
      * Broadcast Action: Indicates the trusted storage has changed. Sent when
      * one of this happens:
@@ -191,9 +190,49 @@ public final class KeyChain {
      * <li>trusted storage is reset (all user certs are cleared),
      * <li>when permission to access a private key is changed.
      * </ul>
+     *
+     * @deprecated Use {@link #ACTION_KEYCHAIN_CHANGED}, {@link #ACTION_STORAGE_CHANGED} or
+     * {@link #ACTION_KEY_ACCESS_CHANGED}.
      */
     public static final String ACTION_STORAGE_CHANGED = "android.security.STORAGE_CHANGED";
 
+    /**
+     * Broadcast Action: Indicates the contents of the keychain has changed. Sent when a KeyChain
+     * entry is added, modified or removed.
+     */
+    public static final String ACTION_KEYCHAIN_CHANGED = "android.security.action.KEYCHAIN_CHANGED";
+
+    /**
+     * Broadcast Action: Indicates the contents of the trusted certificate store has changed. Sent
+     * when one the following occurs:
+     *
+     * <ul>
+     * <li>A pre-installed CA is disabled or re-enabled</li>
+     * <li>A CA is added or removed from the trust store</li>
+     * </ul>
+     */
+    public static final String ACTION_TRUST_STORE_CHANGED =
+            "android.security.action.TRUST_STORE_CHANGED";
+
+    /**
+     * Broadcast Action: Indicates that the access permissions for a private key have changed.
+     *
+     */
+    public static final String ACTION_KEY_ACCESS_CHANGED =
+            "android.security.action.KEY_ACCESS_CHANGED";
+
+    /**
+     * Used as a String extra field in {@link #ACTION_KEY_ACCESS_CHANGED} to supply the alias of
+     * the key.
+     */
+    public static final String EXTRA_KEY_ALIAS = "android.security.extra.KEY_ALIAS";
+
+    /**
+     * Used as a boolean extra field in {@link #ACTION_KEY_ACCESS_CHANGED} to supply if the key is
+     * accessible to the application.
+     */
+    public static final String EXTRA_KEY_ACCESSIBLE = "android.security.extra.KEY_ACCESSIBLE";
+
     /**
      * Returns an {@code Intent} that can be used for credential
      * installation. The intent may be used without any extras, in
diff --git a/services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyManagerService.java b/services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyManagerService.java
index ebd27201943d0..c6147e51c783c 100644
--- a/services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyManagerService.java
+++ b/services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyManagerService.java
@@ -486,7 +486,7 @@ public class DevicePolicyManagerService extends IDevicePolicyManager.Stub {
             }
             if (Intent.ACTION_USER_UNLOCKED.equals(action)
                     || Intent.ACTION_USER_STARTED.equals(action)
-                    || KeyChain.ACTION_STORAGE_CHANGED.equals(action)) {
+                    || KeyChain.ACTION_TRUST_STORE_CHANGED.equals(action)) {
                 int userId = intent.getIntExtra(Intent.EXTRA_USER_HANDLE, UserHandle.USER_ALL);
                 new MonitoringCertNotificationTask().execute(userId);
             }
@@ -1585,7 +1585,7 @@ public class DevicePolicyManagerService extends IDevicePolicyManager.Stub {
         filter.addAction(Intent.ACTION_USER_REMOVED);
         filter.addAction(Intent.ACTION_USER_STARTED);
         filter.addAction(Intent.ACTION_USER_UNLOCKED);
-        filter.addAction(KeyChain.ACTION_STORAGE_CHANGED);
+        filter.addAction(KeyChain.ACTION_TRUST_STORE_CHANGED);
         filter.setPriority(IntentFilter.SYSTEM_HIGH_PRIORITY);
         mContext.registerReceiverAsUser(mReceiver, UserHandle.ALL, filter, null, mHandler);
         filter = new IntentFilter();