The present invention relates to communications technologies, and disclosed are a key updating method, device, and system. A local eNB monitors a user plane uplink and downlink PDCP COUNT value of each UE connected thereto, and transmits user plane uplink and downlink PDCP COUNT value information or transmits a key update request based on the PDCP COUNT value to a macro eNB, so that the macro eNB updates a key according to the key update request or the user plane uplink and downlink PDCP COUNT value information, thereby avoiding the problem of repeated use of security parameters, realizing prompt key update, and improving the security performance of the network.