A key derivation method and an apparatus are provided. In the method, an access and mobility management network element receives a first registration request message from a terminal device, where the first registration request message is to request to register to a network over a first 3GPP access; generates a first key; and sends the first key to a first access network device, where the first key is for communication between the terminal device and the first access network device; receives a second registration request message from the terminal device, where the second registration request message is to request to register to the network over a second 3GPP access; generates a second key different from the first key, where the second key is for communication between the terminal device and a second access network device; and sends the second key to the second access network device.