Patent ID: 8532301

Claim:
A key distribution method, comprising: notifying, by an application provider management platform, a supplementary security domain of an application provider that is set on a smart card and corresponds to the application provider management platform to generate a public/private key pair including a public cryptographic key and a private cryptographic key; receiving, by the application provider management platform, the public cryptographic key from the supplementary security domain of the application provider through a card issuer management platform, wherein the public cryptographic key has been encrypted by a public key of the application provider obtained in advance and has been signed by a Controlling Authority Supplementary security domain (CASD) that is a trustable third-party supplementary security domain on the smart card; authenticating, by the application provider management platform, a signature and using a private key of the application provider to perform decryption to obtain the public cryptographic key; and sending, by the application provider management platform, a trust point's public key used for external authentication and a certificate of the supplementary security domain of the application provider to the supplementary security domain of the application provider after the trust point's public key and the certificate have been encrypted by the public cryptographic key of the supplementary security domain of the application provider and the encrypted data have been signed by the private key of the application provider, to complete distribution of an cryptographic key of the supplementary security domain wherein before the application provider management platform obtains the public key of the CASD, the method further comprising: creating, by the application provider management platform, the supplementary security domain of the application provider on the smart card, and sending basic information of the supplementary security domain of the application provider to the application provider management platform, wherein the basic information includes identification information and configuration information of the supplementary security domain of the application provider.