A key exchange method, wherein a device to device (D2D) link is established between a first user equipment and a second user equipment, and characterized in that the method comprises: acquiring, by the first user equipment, a first key; and using, by the first user equipment when communicating with the second user equipment by using the D2D link, the first key to protect transmitted information, wherein after the acquiring, by the first user equipment, the first key, the method further comprises: receiving, by the first user equipment, a cryptographic algorithm from a network device, wherein the network device is an evolved Node B (eNB), a mobility management entity, or a proximity service server, and the cryptographic algorithm comprises an encryption algorithm and an integrity protection algorithm; generating, by the first user equipment, an encryption key according to the first key and the encryption algorithm; and generating, by the first user equipment, an integrity protection key according to the first key and the integrity protection algorithm; and the using, by the first user equipment when communicating with the second user equipment by using the D2D link, the first key to protect transmitted information specifically comprises: encrypting, by the first user equipment by using the encryption key and the encryption algorithm, information transmitted on the D2D link; and performing, by the first user equipment by using the integrity protection key and the integrity protection algorithm, integrity protection on the information transmitted on the D2D link. acquiring, by the first user equipment, a first key; and using, by the first user equipment when communicating with the second user equipment by using the D2D link, the first key to protect transmitted information, wherein after the acquiring, by the first user equipment, the first key, the method further comprises: receiving, by the first user equipment, a cryptographic algorithm from a network device, wherein the network device is an evolved Node B (eNB), a mobility management entity, or a proximity service server, and the cryptographic algorithm comprises an encryption algorithm and an integrity protection algorithm; generating, by the first user equipment, an encryption key according to the first key and the encryption algorithm; and generating, by the first user equipment, an integrity protection key according to the first key and the integrity protection algorithm; and receiving, by the first user equipment, a cryptographic algorithm from a network device, wherein the network device is an evolved Node B (eNB), a mobility management entity, or a proximity service server, and the cryptographic algorithm comprises an encryption algorithm and an integrity protection algorithm; generating, by the first user equipment, an encryption key according to the first key and the encryption algorithm; and generating, by the first user equipment, an integrity protection key according to the first key and the integrity protection algorithm; and the using, by the first user equipment when communicating with the second user equipment by using the D2D link, the first key to protect transmitted information specifically comprises: encrypting, by the first user equipment by using the encryption key and the encryption algorithm, information transmitted on the D2D link; and performing, by the first user equipment by using the integrity protection key and the integrity protection algorithm, integrity protection on the information transmitted on the D2D link. encrypting, by the first user equipment by using the encryption key and the encryption algorithm, information transmitted on the D2D link; and performing, by the first user equipment by using the integrity protection key and the integrity protection algorithm, integrity protection on the information transmitted on the D2D link.