Provided are a key derivation method and device. The method includes: acquiring a slice identifier corresponding to a network slice to which a user equipment is currently attached, where the slice identifier uniquely identifies the network slice; and transmitting the slice identifier to a designated communication device. The slice identifier is configured to instruct the designated communication device to derive, according to the slice identifier, an intermediate key required by the network slice. By means of the technical solution described above, the problem in the related art that a slice function cannot be implemented normally due to the fact that different network slices probably use the same intermediate key may be solved, and different network slices may correspond to different intermediate keys, thereby avoiding a case that the slicing function cannot be implemented normally caused by allocating the same intermediate key to different network slices.