A secure communication method, wherein the method comprises: receiving, by a first network device (700; 800; 900; 1000), a first packet and a second packet, wherein the first packet and the second packet belong to first traffic, and all packets comprised in the first traffic match a first traffic differentiation rule; based on a mapping relationship between the first traffic and a first encryption policy group, encrypting, by the first network device (700; 800; 900; 1000), the first packet by using a first encryption policy to obtain a third packet, and encrypting the second packet by using a second encryption policy to obtain a fourth packet, wherein the first encryption policy group comprises the first encryption policy and the second encryption policy, and the first encryption policy and the second encryption policy are different encryption policies; and sending, by the first network device (700; 800; 900; 1000), the third packet and the fourth packet to a second network device (700; 800; 900; 1000), characterized by obtaining, by the first network device (700; 800; 900; 1000), a plurality of second public keys of the second network device (700; 800; 900; 1000); obtaining, by the first network device (700; 800; 900; 1000), policy information associated with each of the plurality of second public keys, wherein the policy information comprises key exchange method information and encryption algorithm information; and creating, by the first network device (700; 800; 900; 1000), the first encryption policy group based on the plurality of second public keys and the policy information associated with each of the plurality of second public keys. receiving, by a first network device (700; 800; 900; 1000), a first packet and a second packet, wherein the first packet and the second packet belong to first traffic, and all packets comprised in the first traffic match a first traffic differentiation rule; based on a mapping relationship between the first traffic and a first encryption policy group, encrypting, by the first network device (700; 800; 900; 1000), the first packet by using a first encryption policy to obtain a third packet, and encrypting the second packet by using a second encryption policy to obtain a fourth packet, wherein the first encryption policy group comprises the first encryption policy and the second encryption policy, and the first encryption policy and the second encryption policy are different encryption policies; and sending, by the first network device (700; 800; 900; 1000), the third packet and the fourth packet to a second network device (700; 800; 900; 1000), characterized by obtaining, by the first network device (700; 800; 900; 1000), a plurality of second public keys of the second network device (700; 800; 900; 1000); obtaining, by the first network device (700; 800; 900; 1000), policy information associated with each of the plurality of second public keys, wherein the policy information comprises key exchange method information and encryption algorithm information; and creating, by the first network device (700; 800; 900; 1000), the first encryption policy group based on the plurality of second public keys and the policy information associated with each of the plurality of second public keys.