A message protection method, applied to handover of a terminal (700, 800) from a first-standard system to a second-standard system, wherein the first-standard system comprises a first mobility management network element (500, 600), and the second-standard system comprises a second mobility management network element (500, 600), the method comprising: generating, by the terminal, a message authentication code, MAC based on a registration request message and an integrity key, wherein the registration request message is to register with the second-standard system, the integrity key is for communication between the first mobility management network element and the terminal, and the MAC is to verify the registration request message; sending, by the terminal, a protected registration request message to the second mobility management network element, wherein the protected registration request message comprises the registration request message and the MAC; and receiving, by the terminal, a command message from the second mobility management network element; deriving, by the terminal, a root key of the second-standard system based on a root key of the first-standard system according to the command message; wherein the first-standard system and the second-standard system are 3 rd Generation Partnership Project, 3GPP, communication systems, and the second-standard system is of an evolved 3GPP system generation as compared to the first-standard system; and wherein, before the generating, by the terminal (700, 800), a MAC based on a registration request message and an integrity key, the method further comprises: determining, by the terminal, that a location update request message does not need to be sent; wherein the determining, by the terminal (700, 800), that a location update request message does not need to be sent comprises: if determining that the first mobility management network element (500, 600) has a capability of verifying integrity of the registration request message for the second-standard system, determining, by the terminal, that the location update request message does not need to be sent. generating, by the terminal, a message authentication code, MAC based on a registration request message and an integrity key, wherein the registration request message is to register with the second-standard system, the integrity key is for communication between the first mobility management network element and the terminal, and the MAC is to verify the registration request message; sending, by the terminal, a protected registration request message to the second mobility management network element, wherein the protected registration request message comprises the registration request message and the MAC; and receiving, by the terminal, a command message from the second mobility management network element; deriving, by the terminal, a root key of the second-standard system based on a root key of the first-standard system according to the command message; wherein the first-standard system and the second-standard system are 3 rd Generation Partnership Project, 3GPP, communication systems, and the second-standard system is of an evolved 3GPP system generation as compared to the first-standard system; and wherein, before the generating, by the terminal (700, 800), a MAC based on a registration request message and an integrity key, the method further comprises: determining, by the terminal, that a location update request message does not need to be sent; wherein the determining, by the terminal (700, 800), that a location update request message does not need to be sent comprises: if determining that the first mobility management network element (500, 600) has a capability of verifying integrity of the registration request message for the second-standard system, determining, by the terminal, that the location update request message does not need to be sent. determining, by the terminal, that a location update request message does not need to be sent; wherein the determining, by the terminal (700, 800), that a location update request message does not need to be sent comprises: if determining that the first mobility management network element (500, 600) has a capability of verifying integrity of the registration request message for the second-standard system, determining, by the terminal, that the location update request message does not need to be sent.