A method for downloading an application, comprising: establishing a connection with a smart card through an Over The Air, OTA, server and a mobile terminal by an outside-card entity management platform; selecting a security domain responsible for application downloading from the smart card after receiving an application downloading request from the smart card, and establishing a security channel with the smart card by the outside-card entity management platform; and downloading the application to the smart card based on the security channel by the outside-card entity management platform, characterized in that the selecting a security domain responsible for application downloading from the smart card specifically comprises: when the application is an application self-owned by a card issuer, a card issuer management platform selects an issuer security domain in the smart card, or, the card issuer management platform creates a supplementary security domain for the application and selects the supplementary security domain; when the application is an application autonomously controlled by an application provider or an application entrusted by an application provider to a card issuer for management, if no supplementary security domain is created for the application, the card issuer management platform selects an issuer security domain, establishes a security channel with the smart card, creates a supplementary security domain, generates a supplementary security domain initial key, and sends the supplementary security domain initial key to an application provider management platform, the application provider management platform selects a supplementary security domain responsible for application downloading, establishes a security channel with the smart card, and updates a supplementary security domain key over the security channel; and if a supplementary security domain has been created for the application, the application provider management platform selects the supplementary security domain responsible for application downloading and updates a supplementary security domain key over the security channel. establishing a connection with a smart card through an Over The Air, OTA, server and a mobile terminal by an outside-card entity management platform; selecting a security domain responsible for application downloading from the smart card after receiving an application downloading request from the smart card, and establishing a security channel with the smart card by the outside-card entity management platform; and downloading the application to the smart card based on the security channel by the outside-card entity management platform, characterized in that the selecting a security domain responsible for application downloading from the smart card specifically comprises: when the application is an application self-owned by a card issuer, a card issuer management platform selects an issuer security domain in the smart card, or, the card issuer management platform creates a supplementary security domain for the application and selects the supplementary security domain; when the application is an application autonomously controlled by an application provider or an application entrusted by an application provider to a card issuer for management, if no supplementary security domain is created for the application, the card issuer management platform selects an issuer security domain, establishes a security channel with the smart card, creates a supplementary security domain, generates a supplementary security domain initial key, and sends the supplementary security domain initial key to an application provider management platform, the application provider management platform selects a supplementary security domain responsible for application downloading, establishes a security channel with the smart card, and updates a supplementary security domain key over the security channel; and if a supplementary security domain has been created for the application, the application provider management platform selects the supplementary security domain responsible for application downloading and updates a supplementary security domain key over the security channel. when the application is an application self-owned by a card issuer, a card issuer management platform selects an issuer security domain in the smart card, or, the card issuer management platform creates a supplementary security domain for the application and selects the supplementary security domain; when the application is an application autonomously controlled by an application provider or an application entrusted by an application provider to a card issuer for management, if no supplementary security domain is created for the application, the card issuer management platform selects an issuer security domain, establishes a security channel with the smart card, creates a supplementary security domain, generates a supplementary security domain initial key, and sends the supplementary security domain initial key to an application provider management platform, the application provider management platform selects a supplementary security domain responsible for application downloading, establishes a security channel with the smart card, and updates a supplementary security domain key over the security channel; and if a supplementary security domain has been created for the application, the application provider management platform selects the supplementary security domain responsible for application downloading and updates a supplementary security domain key over the security channel.