A key distribution method, comprising: receiving, by an identity management server, an ID registration request message that is sent by a terminal by using a unified access gateway UAG, to request to register an ID of the terminal, wherein the ID registration request message comprises AAA authentication information; determining, by the identity management server based on the AAA authentication information, whether AAA authentication on the terminal succeeds; and if the AAA authentication on the terminal succeeds, allocating the ID to the terminal, and sending the ID of the terminal to a key management server; receiving, by the identity management server, a private key of the terminal that is sent by the key management server, wherein the private key is generated by the key management server by using the identity ID of the terminal as a public key; negotiating, by the terminal and the identity management server, to generate a first key; and sending, by the identity management server to the terminal by using the UAG, the ID and the private key of the terminal that are encrypted by using the first key; characterized by before the receiving, by an identity management server, an ID registration request message that is sent by a terminal by using the UAG, the method further comprises: receiving, by the identity management server, the AAA authentication information of the terminal that is sent by the AAA server; and the determining, by the identity management server based on the AAA authentication information, whether AAA authentication on the terminal succeeds specifically comprises: determining, by the identity management server, whether the AAA authentication information of the terminal that is sent by the AAA server is the same as the AAA authentication information comprised in the ID registration request messageregistration and authentication request message sent by the terminal; and if the AAA authentication information of the terminal that is sent by the AAA server is the same as the AAA authentication information comprised in the ID registration request message sent by the terminal, determining that the AAA authentication on the terminal succeeds. receiving, by an identity management server, an ID registration request message that is sent by a terminal by using a unified access gateway UAG, to request to register an ID of the terminal, wherein the ID registration request message comprises AAA authentication information; determining, by the identity management server based on the AAA authentication information, whether AAA authentication on the terminal succeeds; and if the AAA authentication on the terminal succeeds, allocating the ID to the terminal, and sending the ID of the terminal to a key management server; receiving, by the identity management server, a private key of the terminal that is sent by the key management server, wherein the private key is generated by the key management server by using the identity ID of the terminal as a public key; negotiating, by the terminal and the identity management server, to generate a first key; and sending, by the identity management server to the terminal by using the UAG, the ID and the private key of the terminal that are encrypted by using the first key; characterized by before the receiving, by an identity management server, an ID registration request message that is sent by a terminal by using the UAG, the method further comprises: receiving, by the identity management server, the AAA authentication information of the terminal that is sent by the AAA server; and the determining, by the identity management server based on the AAA authentication information, whether AAA authentication on the terminal succeeds specifically comprises: determining, by the identity management server, whether the AAA authentication information of the terminal that is sent by the AAA server is the same as the AAA authentication information comprised in the ID registration request messageregistration and authentication request message sent by the terminal; and if the AAA authentication information of the terminal that is sent by the AAA server is the same as the AAA authentication information comprised in the ID registration request message sent by the terminal, determining that the AAA authentication on the terminal succeeds. receiving, by the identity management server, the AAA authentication information of the terminal that is sent by the AAA server; and the determining, by the identity management server based on the AAA authentication information, whether AAA authentication on the terminal succeeds specifically comprises: determining, by the identity management server, whether the AAA authentication information of the terminal that is sent by the AAA server is the same as the AAA authentication information comprised in the ID registration request messageregistration and authentication request message sent by the terminal; and if the AAA authentication information of the terminal that is sent by the AAA server is the same as the AAA authentication information comprised in the ID registration request message sent by the terminal, determining that the AAA authentication on the terminal succeeds.