A method for securely bootstrapping a device, comprising: sending, by a terminal, a second bootstrap request to a server, wherein the second bootstrap request comprises a node identifier and a transmission channel parameter of the terminal, wherein the node identifier comprises physical hardware identifier information of the terminal, and the transmission channel parameter is used to indicate a transmission channel supported by the terminal; receiving, by the terminal, a second acknowledgment message from the server, wherein the second acknowledgment message carries a transmission channel selected by the server based on the transmission channel parameter; receiving, by the terminal through the transmission channel, a temporary identifier indication message sent by a forwarding apparatus, wherein the temporary identifier indication message comprises a temporary identifier and a temporary key, and the forwarding apparatus is a network element that is configured to send a message to the terminal through the transmission channel selected by the server; and sending, by the terminal, a connection request to the server based on the temporary identifier and the temporary key, wherein the connection request is used to request to establish a secure channel with the server, wherein the second bootstrap request further comprises a security parameter, the security parameter is obtained by the terminal by using a first bootstrap request; and before the sending, by a terminal, a second bootstrap request to a server, the method further comprises: sending, by the terminal, the first bootstrap request to the server, wherein the first bootstrap request comprises the node identifier and the transmission channel parameter of the terminal; and receiving, by the terminal, a first acknowledgment message that is sent by the server according to the first bootstrap request, wherein the first acknowledgment message carries the security parameter, wherein the security parameter is used by the terminal for enabling the server to determine whether the security parameter received from the terminal is a security parameter previously delivered by the server to the terminal, to prevent a denial-of-service attack. sending, by a terminal, a second bootstrap request to a server, wherein the second bootstrap request comprises a node identifier and a transmission channel parameter of the terminal, wherein the node identifier comprises physical hardware identifier information of the terminal, and the transmission channel parameter is used to indicate a transmission channel supported by the terminal; receiving, by the terminal, a second acknowledgment message from the server, wherein the second acknowledgment message carries a transmission channel selected by the server based on the transmission channel parameter; receiving, by the terminal through the transmission channel, a temporary identifier indication message sent by a forwarding apparatus, wherein the temporary identifier indication message comprises a temporary identifier and a temporary key, and the forwarding apparatus is a network element that is configured to send a message to the terminal through the transmission channel selected by the server; and sending, by the terminal, a connection request to the server based on the temporary identifier and the temporary key, wherein the connection request is used to request to establish a secure channel with the server, wherein the second bootstrap request further comprises a security parameter, the security parameter is obtained by the terminal by using a first bootstrap request; and before the sending, by a terminal, a second bootstrap request to a server, the method further comprises: sending, by the terminal, the first bootstrap request to the server, wherein the first bootstrap request comprises the node identifier and the transmission channel parameter of the terminal; and receiving, by the terminal, a first acknowledgment message that is sent by the server according to the first bootstrap request, wherein the first acknowledgment message carries the security parameter, wherein the security parameter is used by the terminal for enabling the server to determine whether the security parameter received from the terminal is a security parameter previously delivered by the server to the terminal, to prevent a denial-of-service attack. sending, by the terminal, the first bootstrap request to the server, wherein the first bootstrap request comprises the node identifier and the transmission channel parameter of the terminal; and receiving, by the terminal, a first acknowledgment message that is sent by the server according to the first bootstrap request, wherein the first acknowledgment message carries the security parameter, wherein the security parameter is used by the terminal for enabling the server to determine whether the security parameter received from the terminal is a security parameter previously delivered by the server to the terminal, to prevent a denial-of-service attack.