A key distribution method, comprising: - a card issuer management platform generating initial keys of a supplementary security domain corresponding to an application provider, and - an application provider management platform receiving the information of the supplementary security domain and the initial keys, the method comprising: - the card issuer management platform importing the initial keys and a root public key trusted for external authentication to the supplementary security domain, and sending information of the supplementary security domain and the initial keys to an application provider management platform; and - the application provider management platform: - selecting the supplementary security domain of an intelligent card by a service terminal according to the information of the supplementary security domain and the initial keys; - generating a public key and a private key of the supplementary security domain as well as a certificate of the supplementary security domain, and encrypting the public key and the private key as well as the certificate of the supplementary security domain and then sending them to the supplementary security domain; and - establishing a secure channel with the supplementary security domain after the application provider management platform has selected the supplementary security domain of the intelligent card by the service terminal according to the information of the supplementary security domain and the initial keys. - a card issuer management platform generating initial keys of a supplementary security domain corresponding to an application provider, and - an application provider management platform receiving the information of the supplementary security domain and the initial keys, the method comprising: - the card issuer management platform importing the initial keys and a root public key trusted for external authentication to the supplementary security domain, and sending information of the supplementary security domain and the initial keys to an application provider management platform; and - the application provider management platform: - selecting the supplementary security domain of an intelligent card by a service terminal according to the information of the supplementary security domain and the initial keys; - generating a public key and a private key of the supplementary security domain as well as a certificate of the supplementary security domain, and encrypting the public key and the private key as well as the certificate of the supplementary security domain and then sending them to the supplementary security domain; and - establishing a secure channel with the supplementary security domain after the application provider management platform has selected the supplementary security domain of the intelligent card by the service terminal according to the information of the supplementary security domain and the initial keys. - the card issuer management platform importing the initial keys and a root public key trusted for external authentication to the supplementary security domain, and sending information of the supplementary security domain and the initial keys to an application provider management platform; and - the application provider management platform: - selecting the supplementary security domain of an intelligent card by a service terminal according to the information of the supplementary security domain and the initial keys; - generating a public key and a private key of the supplementary security domain as well as a certificate of the supplementary security domain, and encrypting the public key and the private key as well as the certificate of the supplementary security domain and then sending them to the supplementary security domain; and - establishing a secure channel with the supplementary security domain after the application provider management platform has selected the supplementary security domain of the intelligent card by the service terminal according to the information of the supplementary security domain and the initial keys. - selecting the supplementary security domain of an intelligent card by a service terminal according to the information of the supplementary security domain and the initial keys; - generating a public key and a private key of the supplementary security domain as well as a certificate of the supplementary security domain, and encrypting the public key and the private key as well as the certificate of the supplementary security domain and then sending them to the supplementary security domain; and - establishing a secure channel with the supplementary security domain after the application provider management platform has selected the supplementary security domain of the intelligent card by the service terminal according to the information of the supplementary security domain and the initial keys.