A security protection method, comprising: receiving (302, 603), by a target access network device from a source access network device, a handover request message including a security policy and a corresponding PDU session identifier of a terminal; wherein the security policy indicates whether to activate a user plane security protection for a PDU session associated with the PDU session identifier; wherein the user plane security protection includes at least one of a user plane encryption protection or a user plane integrity protection; and determining (303, 604), by the target access network device based on the security policy, a user plane protection algorithm corresponding to the PDU session, wherein the user plane protection algorithm, corresponding to the user plane security protection, comprises one or both of a user plane encryption algorithm and a user plane integrity protection algorithm; wherein the method further comprises: sending, by the target access network device via an access and mobility management function node, the security policy of the PDU session received from the source access network device to a session management function node; and if a first security policy received from the session management function node is different from the security policy received from the source access network device, redetermining, by the target access network device, a new user plane protection algorithm and a new user plane protection key according to the first security policy received from the session management function node. receiving (302, 603), by a target access network device from a source access network device, a handover request message including a security policy and a corresponding PDU session identifier of a terminal; wherein the security policy indicates whether to activate a user plane security protection for a PDU session associated with the PDU session identifier; wherein the user plane security protection includes at least one of a user plane encryption protection or a user plane integrity protection; and determining (303, 604), by the target access network device based on the security policy, a user plane protection algorithm corresponding to the PDU session, wherein the user plane protection algorithm, corresponding to the user plane security protection, comprises one or both of a user plane encryption algorithm and a user plane integrity protection algorithm; wherein the method further comprises: sending, by the target access network device via an access and mobility management function node, the security policy of the PDU session received from the source access network device to a session management function node; and if a first security policy received from the session management function node is different from the security policy received from the source access network device, redetermining, by the target access network device, a new user plane protection algorithm and a new user plane protection key according to the first security policy received from the session management function node. sending, by the target access network device via an access and mobility management function node, the security policy of the PDU session received from the source access network device to a session management function node; and if a first security policy received from the session management function node is different from the security policy received from the source access network device, redetermining, by the target access network device, a new user plane protection algorithm and a new user plane protection key according to the first security policy received from the session management function node.