The invention discloses a method for an IPSec tunnel to rapidly process messages. A ciphertext conversation is looked up according to an encrypted message; if the ciphertext conversation is not found, an ciphertext conversation is established; if the ciphertext conversation is found, a secret key is looked up in an IPSec safety association data bank; if the secret key is found, direct decryption is performed, otherwise, the secret key is looked up in a global IPSec safety association data bank; if the secret key is found in the global IPSec safety association data bank, the secret key is added to the IPSec safety association data bank, and the encrypted message is decrypted according to the secret key; a corresponding plaintext conversation is looked up according to a new decrypted IP head; and if the plaintext conversation is found, the plaintext conversation and the ciphertext conversation are associated, otherwise, a new plaintext conversation is established, and the newly established plaintext conversation and the ciphertext are associated. According to an IP quintuple of the decrypted message, the look-up is performed in the plaintext conversation associated with the ciphertext conversation, so that the look-up range is narrowed, the searching time is shortened, the decryption time is further shortened, and the efficiency for processing the messages is accelerated.