A device upgrade method, applied to a device upgrade system, wherein the device upgrade system comprises a control device and a to-be-upgraded device, and the method comprises: receiving, by the control device, first upgrade file data sent by a communications device, wherein the first upgrade file data is upgrade file data generated after the communications device performs first security processing on an upgrade file by using a first key; performing, by the control device, second security processing on the first upgrade file data by using a second key, to generate second upgrade file data, and sending the second upgrade file data to the to-be-upgraded device; and receiving, by the to-be-upgraded device, the second upgrade file data, performing security verification on the second upgrade file data by using a third key and a fourth key, and performing upgrade by using the upgrade file if the verification succeeds, wherein the third key is a verification key matching the first key, and the fourth key is a verification key matching the second key; wherein the first key and the third key are symmetric keys, the second key and the fourth key are symmetric keys, and the method further comprises: generating, by the control device, a target key, and splitting the target key into the first key and the second key; sending, by the control device, the target key to the to-be-upgraded device, and sending the first key to the communications device; and storing, by the control device, the second key, and deleting the target key; or wherein the first key and the third key are symmetric keys, the second key and the fourth key are symmetric keys, and the method further comprises: generating, by the to-be-upgraded device, a target key, and splitting the target key into the first key and the second key; sending, by the to-be-upgraded device, the first key to the communications device, and sending the second key to the control device; and storing, by the to-be-upgraded device, the target key, and deleting the first key and the second key. receiving, by the control device, first upgrade file data sent by a communications device, wherein the first upgrade file data is upgrade file data generated after the communications device performs first security processing on an upgrade file by using a first key; performing, by the control device, second security processing on the first upgrade file data by using a second key, to generate second upgrade file data, and sending the second upgrade file data to the to-be-upgraded device; and receiving, by the to-be-upgraded device, the second upgrade file data, performing security verification on the second upgrade file data by using a third key and a fourth key, and performing upgrade by using the upgrade file if the verification succeeds, wherein the third key is a verification key matching the first key, and the fourth key is a verification key matching the second key; wherein the first key and the third key are symmetric keys, the second key and the fourth key are symmetric keys, and the method further comprises: generating, by the control device, a target key, and splitting the target key into the first key and the second key; sending, by the control device, the target key to the to-be-upgraded device, and sending the first key to the communications device; and storing, by the control device, the second key, and deleting the target key; or wherein the first key and the third key are symmetric keys, the second key and the fourth key are symmetric keys, and the method further comprises: generating, by the to-be-upgraded device, a target key, and splitting the target key into the first key and the second key; sending, by the to-be-upgraded device, the first key to the communications device, and sending the second key to the control device; and storing, by the to-be-upgraded device, the target key, and deleting the first key and the second key. generating, by the control device, a target key, and splitting the target key into the first key and the second key; sending, by the control device, the target key to the to-be-upgraded device, and sending the first key to the communications device; and storing, by the control device, the second key, and deleting the target key; or wherein the first key and the third key are symmetric keys, the second key and the fourth key are symmetric keys, and the method further comprises: generating, by the to-be-upgraded device, a target key, and splitting the target key into the first key and the second key; sending, by the to-be-upgraded device, the first key to the communications device, and sending the second key to the control device; and storing, by the to-be-upgraded device, the target key, and deleting the first key and the second key. generating, by the to-be-upgraded device, a target key, and splitting the target key into the first key and the second key; sending, by the to-be-upgraded device, the first key to the communications device, and sending the second key to the control device; and storing, by the to-be-upgraded device, the target key, and deleting the first key and the second key.