A message protection method, characterized by comprising: receiving, by user equipment, UE, by using a GPRS mobility management, GMM/session management, SM, protocol layer of the UE, an authentication and key agreement request message from a serving GPRS support node, SGSN, wherein the authentication and key agreement request message carries a first message authentication code and a first algorithm identifier, and the first algorithm identifier is used to indicate a first algorithm; obtaining, by the UE, the first algorithm identifier on the GMM/SM protocol layer of the UE according to the authentication and key agreement request message and generating a first key; verifying, by the UE, the first message authentication code on the GMM/SM protocol layer of the UE according to the first key and the first algorithm; generating, by the UE when the UE determines that the verification of the first message authentication code succeeds, an authentication and key agreement response message on the GMM/SM protocol layer of the UE according to the first key and the first algorithm, wherein the authentication and key agreement response message carries a second message authentication code; and sending, by the UE, the authentication and key agreement response message to the SGSN by using the GMM/SM protocol layer of the UE; wherein after the sending, by the UE, the authentication and key agreement response message to the SGSN by using the GMM/SM protocol layer of the UE, the method further comprises: sending, by the UE, the first key and the first algorithm identifier to a logical link control, LLC, protocol layer of the UE by using the GMM/SM protocol layer of the UE; ciphering, by the UE, user plane data and control plane signaling on the LLC protocol layer of the UE by using the first ciphering key and the first ciphering algorithm indicated by the first ciphering algorithm identifier; and performing, by the UE, integrity protection for the control plane signaling on the LLC protocol layer of the UE by using the first integrity key and the first integrity protection algorithm indicated by the first integrity protection algorithm identifier. receiving, by user equipment, UE, by using a GPRS mobility management, GMM/session management, SM, protocol layer of the UE, an authentication and key agreement request message from a serving GPRS support node, SGSN, wherein the authentication and key agreement request message carries a first message authentication code and a first algorithm identifier, and the first algorithm identifier is used to indicate a first algorithm; obtaining, by the UE, the first algorithm identifier on the GMM/SM protocol layer of the UE according to the authentication and key agreement request message and generating a first key; verifying, by the UE, the first message authentication code on the GMM/SM protocol layer of the UE according to the first key and the first algorithm; generating, by the UE when the UE determines that the verification of the first message authentication code succeeds, an authentication and key agreement response message on the GMM/SM protocol layer of the UE according to the first key and the first algorithm, wherein the authentication and key agreement response message carries a second message authentication code; and sending, by the UE, the authentication and key agreement response message to the SGSN by using the GMM/SM protocol layer of the UE; wherein after the sending, by the UE, the authentication and key agreement response message to the SGSN by using the GMM/SM protocol layer of the UE, the method further comprises: sending, by the UE, the first key and the first algorithm identifier to a logical link control, LLC, protocol layer of the UE by using the GMM/SM protocol layer of the UE; ciphering, by the UE, user plane data and control plane signaling on the LLC protocol layer of the UE by using the first ciphering key and the first ciphering algorithm indicated by the first ciphering algorithm identifier; and performing, by the UE, integrity protection for the control plane signaling on the LLC protocol layer of the UE by using the first integrity key and the first integrity protection algorithm indicated by the first integrity protection algorithm identifier. sending, by the UE, the first key and the first algorithm identifier to a logical link control, LLC, protocol layer of the UE by using the GMM/SM protocol layer of the UE; ciphering, by the UE, user plane data and control plane signaling on the LLC protocol layer of the UE by using the first ciphering key and the first ciphering algorithm indicated by the first ciphering algorithm identifier; and performing, by the UE, integrity protection for the control plane signaling on the LLC protocol layer of the UE by using the first integrity key and the first integrity protection algorithm indicated by the first integrity protection algorithm identifier.