A packet processing method, applied to a scenario in which a relay device forwards a packet between a first node and a second node, comprising: receiving, by the first node, a first packet sent by the relay device, wherein the first packet comprises data in a second packet sent by the second node to the relay device, the data in the second packet is encrypted by using second additional authentication data and a session key between the first node and the second node, the second additional authentication data is generated by the second node according to at least address information in a packet header of the second packet by using a second rule, and the address information in the packet header of the second packet indicates that a receiving party of the second packet is the relay device, a sending party is the second node, and a next receiving party is the first node; generating, by the first node, first additional authentication data according to at least address information in a packet header of the first packet by using a first rule, wherein the address information comprised in the packet header of the first packet indicates that a receiving party of the first packet is the first node, a sending party is the relay device, and a previous sending party is the second node, and the first additional authentication data is the same as the second additional authentication data; and decrypting, by the first node, data in the first packet by using the first additional authentication data and the session key between the first node and the second node; wherein the first rule is that a sequence of addresses in the first additional authentication data is the same as a sequence of addresses in the packet header of the first packet, and the second rule is that a sequence of addresses in the second additional authentication data is different from a sequence of addresses in the packet header of the second packet, so that the sequence of the addresses in the second additional authentication data is the same as the sequence of the addresses in the first additional authentication data; or the first rule is that a sequence of addresses in the first additional authentication data is different from a sequence of addresses in the packet header of the first packet, and the second rule is that a sequence of addresses in the second additional authentication data is the same as a sequence of addresses in the packet header of the second packet, so that the sequence of the addresses in the second additional authentication data is the same as the sequence of the addresses in the first additional authentication data. receiving, by the first node, a first packet sent by the relay device, wherein the first packet comprises data in a second packet sent by the second node to the relay device, the data in the second packet is encrypted by using second additional authentication data and a session key between the first node and the second node, the second additional authentication data is generated by the second node according to at least address information in a packet header of the second packet by using a second rule, and the address information in the packet header of the second packet indicates that a receiving party of the second packet is the relay device, a sending party is the second node, and a next receiving party is the first node; generating, by the first node, first additional authentication data according to at least address information in a packet header of the first packet by using a first rule, wherein the address information comprised in the packet header of the first packet indicates that a receiving party of the first packet is the first node, a sending party is the relay device, and a previous sending party is the second node, and the first additional authentication data is the same as the second additional authentication data; and decrypting, by the first node, data in the first packet by using the first additional authentication data and the session key between the first node and the second node; wherein the first rule is that a sequence of addresses in the first additional authentication data is the same as a sequence of addresses in the packet header of the first packet, and the second rule is that a sequence of addresses in the second additional authentication data is different from a sequence of addresses in the packet header of the second packet, so that the sequence of the addresses in the second additional authentication data is the same as the sequence of the addresses in the first additional authentication data; or the first rule is that a sequence of addresses in the first additional authentication data is different from a sequence of addresses in the packet header of the first packet, and the second rule is that a sequence of addresses in the second additional authentication data is the same as a sequence of addresses in the packet header of the second packet, so that the sequence of the addresses in the second additional authentication data is the same as the sequence of the addresses in the first additional authentication data.