A security configuration method for a radio bearer, comprising: obtaining, by a base station, a first security configuration message, wherein the first security configuration message is used to indicate whether security configuration needs to be performed on each of N radio bearers set up between the base station and a terminal device, and indicate security configuration parameters for M radio bearers on which security configuration needs to be performed, wherein N is a positive integer, M is an integer, and M≤N; and sending, by the base station, the first security configuration message to the terminal device; wherein the obtaining, by a base station, a first security configuration message comprises: receiving, by the base station, a second security configuration message sent by a management entity, wherein the second security configuration message is used to indicate whether security configuration needs to be performed on each of L radio bearers corresponding to the management entity, and indicate security configuration parameters for K radio bearers on which security configuration needs to be performed, wherein L is a positive integer greater than or equal to N, and K is an integer greater than or equal to M; and generating, by the base station, the first security configuration message based on the second security configuration message and a context of the terminal device. obtaining, by a base station, a first security configuration message, wherein the first security configuration message is used to indicate whether security configuration needs to be performed on each of N radio bearers set up between the base station and a terminal device, and indicate security configuration parameters for M radio bearers on which security configuration needs to be performed, wherein N is a positive integer, M is an integer, and M≤N; and sending, by the base station, the first security configuration message to the terminal device; wherein the obtaining, by a base station, a first security configuration message comprises: receiving, by the base station, a second security configuration message sent by a management entity, wherein the second security configuration message is used to indicate whether security configuration needs to be performed on each of L radio bearers corresponding to the management entity, and indicate security configuration parameters for K radio bearers on which security configuration needs to be performed, wherein L is a positive integer greater than or equal to N, and K is an integer greater than or equal to M; and generating, by the base station, the first security configuration message based on the second security configuration message and a context of the terminal device. receiving, by the base station, a second security configuration message sent by a management entity, wherein the second security configuration message is used to indicate whether security configuration needs to be performed on each of L radio bearers corresponding to the management entity, and indicate security configuration parameters for K radio bearers on which security configuration needs to be performed, wherein L is a positive integer greater than or equal to N, and K is an integer greater than or equal to M; and generating, by the base station, the first security configuration message based on the second security configuration message and a context of the terminal device.