A connection establishment method, a device, and a system are disclosed to resolve a problem in the prior art that because first user equipment is connected to any user equipment, security of a relay service function is poor. A specific solution is: receiving, by first user equipment, a served object group identifier sent by a network device; receiving discovery information sent by second user equipment; and when determining that an identifier of a second group is included in the served object group identifier, establishing a connection between the first user equipment and the second user equipment according to a data link layer ID of the second user equipment.