A service path protection method, comprising: for an end node of a protection path, sending, by an SDN controller, a path selection instruction to the end node of the protection path, wherein the path selection instruction comprises a service path and protection path activation type, a forwarding relationship of a service path in the end node, and a forwarding relationship of the protection path in the end node, wherein the forwarding relationship of the service path in the end node is an ingress port and an egress port that the service path passes through in the end node, and the forwarding relationship of the protection path in the end node is an ingress port and an egress port that the protection path passes through in the end node; and the service path and protection path activation type is used by the end node of the protection path to activate at least one forwarding relationship of the forwarding relationship of the service path in the end node and the forwarding relationship of the protection path in the end node according to the service path and protection path activation type; and when it is determined that a fault occurs in the service path, the end node of the protection path updates the at least one forwarding relationship of the forwarding relationship of the service path in the end node and the forwarding relationship of the protection path in the end node according to the service path and protection path activation type, wherein the protection path is a standby path for protecting a path between specified nodes on the service path; wherein when there are at least two protection paths for the path between the specified nodes on the service path, the path selection instruction is further used to indicate priorities of the protection paths. for an end node of a protection path, sending, by an SDN controller, a path selection instruction to the end node of the protection path, wherein the path selection instruction comprises a service path and protection path activation type, a forwarding relationship of a service path in the end node, and a forwarding relationship of the protection path in the end node, wherein the forwarding relationship of the service path in the end node is an ingress port and an egress port that the service path passes through in the end node, and the forwarding relationship of the protection path in the end node is an ingress port and an egress port that the protection path passes through in the end node; and the service path and protection path activation type is used by the end node of the protection path to activate at least one forwarding relationship of the forwarding relationship of the service path in the end node and the forwarding relationship of the protection path in the end node according to the service path and protection path activation type; and when it is determined that a fault occurs in the service path, the end node of the protection path updates the at least one forwarding relationship of the forwarding relationship of the service path in the end node and the forwarding relationship of the protection path in the end node according to the service path and protection path activation type, wherein the protection path is a standby path for protecting a path between specified nodes on the service path; wherein when there are at least two protection paths for the path between the specified nodes on the service path, the path selection instruction is further used to indicate priorities of the protection paths.