A network handover protection method, comprising: receiving, by a session management device, a path switching request used to request to hand over user equipment UE from a source network to a target network, wherein the source network is a network on which the UE currently camps; obtaining, by the session management device, a target security policy based on the path switching request, wherein the target security policy is an initial security policy or a security policy obtained by processing the initial security policy according to a preset rule, the initial security policy defines a manner of generating a reference shared key, the reference shared key is a key generated based on a base key and is used by the UE to perform end-to-end protection on secure data transmission in the source network, and the base key is a key generated through two-way authentication between the UE and the source network or a key derived based on the key generated through two-way authentication between the UE and the source network; obtaining, by the session management device, a second shared key generated based on a first shared key and the target security policy, and sending the second shared key to a target gateway; or sending the target security policy and the pre-obtained first shared key to the target gateway, so that the target gateway generates the second shared key based on the first shared key and the target security policy, wherein the first shared key is the reference shared key or the base key, and the target gateway is a user plane gateway of the target network; and sending, by the session management device, the second shared key to the UE; or sending the target security policy to the UE, so that the UE generates the second shared key based on the first shared key and the target security policy, wherein the second shared key is used to perform end-to-end protection on secure data transmission between the UE and the target gateway. receiving, by a session management device, a path switching request used to request to hand over user equipment UE from a source network to a target network, wherein the source network is a network on which the UE currently camps; obtaining, by the session management device, a target security policy based on the path switching request, wherein the target security policy is an initial security policy or a security policy obtained by processing the initial security policy according to a preset rule, the initial security policy defines a manner of generating a reference shared key, the reference shared key is a key generated based on a base key and is used by the UE to perform end-to-end protection on secure data transmission in the source network, and the base key is a key generated through two-way authentication between the UE and the source network or a key derived based on the key generated through two-way authentication between the UE and the source network; obtaining, by the session management device, a second shared key generated based on a first shared key and the target security policy, and sending the second shared key to a target gateway; or sending the target security policy and the pre-obtained first shared key to the target gateway, so that the target gateway generates the second shared key based on the first shared key and the target security policy, wherein the first shared key is the reference shared key or the base key, and the target gateway is a user plane gateway of the target network; and sending, by the session management device, the second shared key to the UE; or sending the target security policy to the UE, so that the UE generates the second shared key based on the first shared key and the target security policy, wherein the second shared key is used to perform end-to-end protection on secure data transmission between the UE and the target gateway.