An apparatus used for security information interaction comprising: a first system management device for providing an operational environment for routine applications; a second system management device for providing an operational environment in a safe mode for security applications so as to perform a security information interaction process; wherein, in case that the current application to be operated is a routine application, the apparatus used for security information interaction selects the first system management device as a currently used system management device, and in case that the current application to be operated is a security application, the apparatus used for security information interaction selects the second system management device as a currently used system management device, wherein the resource used by the second system management device is isolated from the resource used by the first system management device, wherein the second system management device further comprises: an external device interface for providing a safe data communication interface for various types of external security carriers; a virtual security carrier manager which, based on a virtual security carrier creating request received from a virtual security carrier server and an associated safety certificate, creates and initializes a virtual security carrier; a communication module for establishing a data communication link in a peer to peer mode between two or more data processing nodes, wherein the data processing nodes comprise the external security carriers, the virtual security carrier and any other associated internal or external devices or functional units; and a user interface for providing a human-machine interactive interface for the external security carriers and/or the virtual security carrier in a mutual authentication manner, wherein the virtual security carrier manager assigns separate resources for each created virtual security carrier so as to provide mutual isolation between different virtual security carriers. a first system management device for providing an operational environment for routine applications; a second system management device for providing an operational environment in a safe mode for security applications so as to perform a security information interaction process; wherein, in case that the current application to be operated is a routine application, the apparatus used for security information interaction selects the first system management device as a currently used system management device, and in case that the current application to be operated is a security application, the apparatus used for security information interaction selects the second system management device as a currently used system management device, wherein the resource used by the second system management device is isolated from the resource used by the first system management device, wherein the second system management device further comprises: an external device interface for providing a safe data communication interface for various types of external security carriers; a virtual security carrier manager which, based on a virtual security carrier creating request received from a virtual security carrier server and an associated safety certificate, creates and initializes a virtual security carrier; a communication module for establishing a data communication link in a peer to peer mode between two or more data processing nodes, wherein the data processing nodes comprise the external security carriers, the virtual security carrier and any other associated internal or external devices or functional units; and a user interface for providing a human-machine interactive interface for the external security carriers and/or the virtual security carrier in a mutual authentication manner, wherein the virtual security carrier manager assigns separate resources for each created virtual security carrier so as to provide mutual isolation between different virtual security carriers. an external device interface for providing a safe data communication interface for various types of external security carriers; a virtual security carrier manager which, based on a virtual security carrier creating request received from a virtual security carrier server and an associated safety certificate, creates and initializes a virtual security carrier; a communication module for establishing a data communication link in a peer to peer mode between two or more data processing nodes, wherein the data processing nodes comprise the external security carriers, the virtual security carrier and any other associated internal or external devices or functional units; and a user interface for providing a human-machine interactive interface for the external security carriers and/or the virtual security carrier in a mutual authentication manner, wherein the virtual security carrier manager assigns separate resources for each created virtual security carrier so as to provide mutual isolation between different virtual security carriers.