An application can use this API to Create secure channel via SCP11.

 try {
   Bundle bundle = new Bundle();
   bundle.putInt(SecureChannelManager.BUNDLE_EXTRA_SCP_PROTOCOL, SecureChannelManager.PROTOCOL_TYPE_SCP11B);
   bundle.putInt(SecureChannelManager.BUNDLE_EXTRA_SCP_KEY_ID, 0);
   bundle.putInt(SecureChannelManager.BUNDLE_EXTRA_SCP_KEY_ID, 1);
   bundle.putInt(SecureChannelManager.BUNDLE_EXTRA_SCP_KEY_LENGTH, keyLength); // must be 0x20 : AES256
   bundle.putBoolean(SecureChannelManager.BUNDLE_EXTRA_SCP_ENCRYPTION, encEnabled); // must be true : enabled
   bundle.putBoolean(SecureChannelManager.BUNDLE_EXTRA_SCP_MAC, macEnabled); // must be true : enabled
   bundle.putInt(SecureChannelManager.BUNDLE_EXTRA_SCP_KEY_PARAM_ECC, SecureChannelManager.BUNDLE_SCP_KEY_PARAM_ECC_NIST_P256); // ECC curve : NIST-P256
 
   SecureChannelManager credentialUtil = SecureChannelManager.getInstance();
   ApduMessage resp = credentialUtil.createSecureChannel(protocol, bundle);
   if(resp.status == SecureChannelManager.STATUS_FAILURE) {
     Log.e(TAG, "Channel construction failed");
     return;
   }

   while (resp.messageType == SecureChannelManager.MESSAGE_TYPE_FORWARD_TO_SD) {
     Log.e(TAG, "FORWARDING : " + Hex.toHexString(resp.message));
     // forward APDU to your SD
     byte[] sdResp = transmitData(resp.message);
     if(sdResp == null || sdResp.length < 2) {
       Log.e(TAG, "sdResp == null");
       return;
     }

     resp = credentialUtil.processMessage(SecureChannelManager.MESSAGE_TYPE_SECURE_CHANNEL, sdResp);
     switch(resp.status) {
       case SecureChannelManager.STATUS_SUCCESS:
         if(resp.messageType == SecureChannelManager.MESSAGE_TYPE_FORWARD_TO_SD)
           continue;
       case SecureChannelManager.STATUS_SC_CONSTRUCTED:
         Log.e(TAG, "Channel constructed!");
         break;
       default:
         mSecureChannelExists = false;
         Log.e(TAG, "Channel construction failed");
         break;
       }
    }
 } catch (SecurityException e) {
   Log.w(TAG, "SecurityException: " + e);
 }
 

An application can use this API to destroy secure channel.

 SecureChannelManager credManager = SecureChannelManager.getInstance();
 
 try {
   int result = credManager.destroySecureChannel();
 } catch (SecurityException e) {
   Log.w(TAG, "SecurityException: " + e);
 }
 

An application can use this API to Process message via SCP11.

 try {
   SecureChannelManager credentialUtil = SecureChannelManager.getInstance();

   // Encrypt response
   resp = credentialUtil.processMessage(SecureChannelManager.MESSAGE_TYPE_COMMAND, data);
   if (resp.status != SecureChannelManager.STATUS_SUCCESS) {
     Log.e(TAG, "Command encryption failed");
   } else {
     Log.e(TAG, "encrypted length : " + resp.message.length);
   }

   // forward APDU to your SD
   byte[] sdResp = transmitData(resp.message);

   // Decrypt response
   resp = credentialUtil.processMessage(SecureChannelManager.MESSAGE_TYPE_RESPONSE, data);
   if (resp == null || resp.status != SecureChannelManager.STATUS_SUCCESS) {
     Log.e(TAG, "Response decryption failed");
     break;
   } else {
     Log.d(TAG,"decrypt success." + new String(resp.message));
   }
 } catch (SecurityException e) {
   Log.w(TAG, "SecurityException: " + e);
 }