A method for processing a data security channel of a tunnel, comprising: receiving, by an authentication and authorization device, an authentication and authorization request of an access side, and determining a trust relationship of access of a user equipment; and sending, by the authentication and authorization device, a message comprising information about the trust relationship to a packet data gateway when the authentication and authorization device determines that an S6b interface session of the user equipment exists, characterized by establishing or updating, by the packet data gateway, a data security channel of an S2c tunnel according to the information about the trust relationship; wherein when the information about the trust relationship indicates that the access of the user equipment is trusted access, the establishing or updating, by the packet data gateway, a data security channel of a S2c tunnel according to the information about the trust relationship comprises: initiating, by the packet data gateway, a procedure for establishing a child security association, Child SA, with the user equipment; or accepting a Child SA establishment request initiated by the user equipment; wherein when the information about the trust relationship indicates that the access of the user equipment is untrusted access, the establishing or updating, by the packet data gateway, a data security channel of an S2c tunnel according to the information about the trust relationship comprises: rejecting a Child SA establishment request sent by the user equipment; or deleting a Child SA with the user equipment; wherein the rejecting a Child SA establishment request sent by the user equipment comprises: indicating, in a response message for the Child SA establishment request, that the Child SA establishment request sent by the user equipment is not accepted. receiving, by an authentication and authorization device, an authentication and authorization request of an access side, and determining a trust relationship of access of a user equipment; and sending, by the authentication and authorization device, a message comprising information about the trust relationship to a packet data gateway when the authentication and authorization device determines that an S6b interface session of the user equipment exists, characterized by establishing or updating, by the packet data gateway, a data security channel of an S2c tunnel according to the information about the trust relationship; wherein when the information about the trust relationship indicates that the access of the user equipment is trusted access, the establishing or updating, by the packet data gateway, a data security channel of a S2c tunnel according to the information about the trust relationship comprises: initiating, by the packet data gateway, a procedure for establishing a child security association, Child SA, with the user equipment; or accepting a Child SA establishment request initiated by the user equipment; initiating, by the packet data gateway, a procedure for establishing a child security association, Child SA, with the user equipment; or accepting a Child SA establishment request initiated by the user equipment; wherein when the information about the trust relationship indicates that the access of the user equipment is untrusted access, the establishing or updating, by the packet data gateway, a data security channel of an S2c tunnel according to the information about the trust relationship comprises: rejecting a Child SA establishment request sent by the user equipment; or deleting a Child SA with the user equipment; rejecting a Child SA establishment request sent by the user equipment; or deleting a Child SA with the user equipment; wherein the rejecting a Child SA establishment request sent by the user equipment comprises: indicating, in a response message for the Child SA establishment request, that the Child SA establishment request sent by the user equipment is not accepted.