diff --git a/frameworks/deviceauth_lite/source/auth_info/add_auth_info.c b/frameworks/deviceauth_lite/source/auth_info/add_auth_info.c
index 06d4da9..5354457 100644
--- a/frameworks/deviceauth_lite/source/auth_info/add_auth_info.c
+++ b/frameworks/deviceauth_lite/source/auth_info/add_auth_info.c
@@ -151,6 +151,7 @@ static int32_t save_import_auth_info(const struct hichain *hichain, const struct
     }
 
     int32_t ret = save_auth_info(hichain, pair_type, &cache);
+    (void)memset_s(&cache.ltpk, sizeof(struct ltpk), 0, sizeof(struct ltpk));
     if (ret != HC_OK) {
         LOGE("Save auth info failed, error code is %d", ret);
         return HC_IMPORT_AUTH_DATA_FAILED;
@@ -202,6 +203,7 @@ int32_t import_signed_auth_info_hilink(const struct hichain *hichain, const stru
 
     struct signature sign_result = { 0, {0} };
     if (memcpy_s(sign_result.signature, sizeof(sign_result.signature), receive_data, HC_SIGNATURE_LEN) != EOK) {
+        (void)memset_s(receive_data, len, 0, len);
         FREE(receive_data);
         return memory_copy_error(__func__, __LINE__);
     }
@@ -214,18 +216,23 @@ int32_t import_signed_auth_info_hilink(const struct hichain *hichain, const stru
         (char *)message.val, JSON_STRING_DATA);
     if (import_data == NULL) {
         LOGE("Parse import add auth data failed");
+        (void)memset_s(receive_data, len, 0, len);
         FREE(receive_data);
         return HC_BUILD_OBJECT_FAILED;
     }
 
     int32_t ret = verify_import_auth_info(hichain, import_data, &message, &sign_result);
     if (ret != HC_OK) {
+        (void)memset_s(receive_data, len, 0, len);
+        (void)memset_s(&import_data->ltpk, sizeof(struct ltpk), 0, sizeof(struct ltpk));
         FREE(receive_data);
         free_import_add_auth_data(import_data);
         return ret;
     }
 
     ret = save_import_auth_info(hichain, auth_id, import_data);
+    (void)memset_s(receive_data, len, 0, len);
+    (void)memset_s(&import_data->ltpk, sizeof(struct ltpk), 0, sizeof(struct ltpk));
     FREE(receive_data);
     free_import_add_auth_data(import_data);
     return ret;
@@ -262,11 +269,13 @@ int32_t import_signed_auth_info(const struct hichain *hichain, const struct hc_a
     int32_t ret = verify_import_auth_info(hichain, import_data, &message, &sign_result);
     if (ret != HC_OK) {
         LOGE("Verify failed!");
+        (void)memset_s(&import_data->ltpk, sizeof(struct ltpk), 0, sizeof(struct ltpk));
         free_import_add_auth_data(import_data);
         return ret;
     }
 
     ret = save_import_auth_info(hichain, auth_id, import_data);
+    (void)memset_s(&import_data->ltpk, sizeof(struct ltpk), 0, sizeof(struct ltpk));
     free_import_add_auth_data(import_data);
     LOGI("Import signed auth info success");
     return ret;
@@ -310,6 +319,7 @@ int32_t import_lite_auth_info(const struct hichain *hichain, const struct hc_aut
 
     struct import_auth_data *import_data = (struct import_auth_data *)parse_import_add_auth_data(
         (char *)out_plain.val, JSON_STRING_DATA);
+    (void)memset_s(out_plain.val, data->length, 0, data->length);
     free_import_add_auth_data(out_plain.val);
     out_plain.val = NULL;
     if (import_data == NULL) {
@@ -318,6 +328,7 @@ int32_t import_lite_auth_info(const struct hichain *hichain, const struct hc_aut
     }
 
     ret = save_import_auth_info(hichain, auth_id, import_data);
+    (void)memset_s(&import_data->ltpk, sizeof(struct ltpk), 0, sizeof(struct ltpk));
     free_import_add_auth_data(import_data);
     if (ret != HC_OK) {
         LOGE("Import lite auth info failed");
diff --git a/frameworks/deviceauth_lite/source/key_agreement/pake_client.c b/frameworks/deviceauth_lite/source/key_agreement/pake_client.c
index 95df4d9..62ba235 100644
--- a/frameworks/deviceauth_lite/source/key_agreement/pake_client.c
+++ b/frameworks/deviceauth_lite/source/key_agreement/pake_client.c
@@ -65,6 +65,11 @@ void destroy_pake_client(struct pake_client *pake_client)
     }
 
     LOGI("Destroy pake client object %u success", pake_client_sn(pake_client));
+    (void)memset_s(&pake_client->pin, sizeof(struct hc_pin), 0, sizeof(struct hc_pin));
+    (void)memset_s(&pake_client->self_esk, sizeof(struct esk), 0, sizeof(struct esk));
+    (void)memset_s(&pake_client->session_key, sizeof(struct pake_session_key), 0, sizeof(struct pake_session_key));
+    (void)memset_s(&pake_client->hmac_key, sizeof(struct pake_hmac_key), 0, sizeof(struct pake_hmac_key));
+    (void)memset_s(&pake_client->service_key, sizeof(struct hc_session_key), 0, sizeof(struct hc_session_key));
     FREE(pake_client);
 }
 
@@ -204,12 +209,14 @@ static int32_t parse_start_response_data(void *handle, void *data)
     uint32_t prime_len = 0;
     ret = gen_esk_prime_len(pake_client, receive, &esk_len, &prime_len);
     if (ret != HC_OK) {
+        (void)memset_s(&secret, sizeof(struct hkdf), 0, sizeof(struct hkdf));
         return ret;
     }
     if (pake_client->client_info.protocol_base_info.state == START_REQUEST) {
         struct random_value rand = generate_random(esk_len);
         if (rand.length == 0) {
             LOGE("Generate random value failed");
+            (void)memset_s(&secret, sizeof(struct hkdf), 0, sizeof(struct hkdf));
             return HC_GEN_RANDOM_FAILED;
         }
 
@@ -222,6 +229,7 @@ static int32_t parse_start_response_data(void *handle, void *data)
 
     ret = cal_bignum_exp((struct var_buffer *)&secret, (struct var_buffer *)&exp,
                          prime_len, (struct big_num *)&base);
+    (void)memset_s(&secret, sizeof(struct hkdf), 0, sizeof(struct hkdf));
     if (ret != HC_OK) {
         return HC_CAL_BIGNUM_EXP_FAILED;
     }
@@ -306,6 +314,7 @@ static int32_t generate_session_key(struct pake_client *pake_client, struct epk
     struct hkdf hkdf = { 0, {0} };
     ret = compute_hkdf((struct var_buffer *)&shared_secret, &pake_client->salt,
                        HICHAIN_SPEKE_SESSIONKEY_INFO, HC_HKDF_SECRET_LEN, (struct var_buffer *)&hkdf);
+    (void)memset_s(&shared_secret, sizeof(struct pake_shared_secret), 0, sizeof(struct pake_shared_secret));
     if (ret != HC_OK) {
         LOGE("Object %u generate hkdf failed, error code is %d", pake_client_sn(pake_client), ret);
         goto error;
@@ -317,6 +326,7 @@ static int32_t generate_session_key(struct pake_client *pake_client, struct epk
                    hkdf.hkdf + PAKE_SESSION_KEY_LENGTH, PAKE_HMAC_KEY_LENGTH);
     pake_client->session_key.length = PAKE_SESSION_KEY_LENGTH;
     pake_client->hmac_key.length = PAKE_HMAC_KEY_LENGTH;
+    (void)memset_s(&hkdf, sizeof(struct hkdf), 0, sizeof(struct hkdf));
     return HC_OK;
 
 error:
diff --git a/frameworks/deviceauth_lite/source/key_agreement/pake_server.c b/frameworks/deviceauth_lite/source/key_agreement/pake_server.c
index d82b73a..cd163c3 100644
--- a/frameworks/deviceauth_lite/source/key_agreement/pake_server.c
+++ b/frameworks/deviceauth_lite/source/key_agreement/pake_server.c
@@ -68,6 +68,11 @@ void destroy_pake_server(struct pake_server *pake_server)
     }
 
     LOGI("Destroy pake server object %u success", pake_server_sn(pake_server));
+    (void)memset_s(&pake_server->pin, sizeof(struct hc_pin), 0, sizeof(struct hc_pin));
+    (void)memset_s(&pake_server->self_esk, sizeof(struct esk), 0, sizeof(struct esk));
+    (void)memset_s(&pake_server->session_key, sizeof(struct pake_session_key), 0, sizeof(struct pake_session_key));
+    (void)memset_s(&pake_server->hmac_key, sizeof(struct pake_hmac_key), 0, sizeof(struct pake_hmac_key));
+    (void)memset_s(&pake_server->service_key, sizeof(struct hc_session_key), 0, sizeof(struct hc_session_key));
     FREE(pake_server);
 }
 
@@ -254,11 +259,13 @@ static int32_t generate_pake_params(struct pake_server *pake_server, struct epk
 
     ret = cal_bignum_exp((struct var_buffer *)&secret, (struct var_buffer *)&exp,
         prime_len, (struct big_num *)&base);
+    (void)memset_s(&secret, sizeof(struct hkdf), 0, sizeof(struct hkdf));
     if (ret != HC_OK) {
         return HC_CAL_BIGNUM_EXP_FAILED;
     }
     ret = cal_bignum_exp((struct var_buffer *)&base, (struct var_buffer *)&pake_server->self_esk,
         prime_len, (struct big_num *)self_epk);
+    (void)memset_s(&base, sizeof(struct epk), 0, sizeof(struct epk));
     if (ret != HC_OK) {
         return HC_CAL_BIGNUM_EXP_FAILED;
     }
@@ -373,6 +380,7 @@ static int32_t generate_session_key(struct pake_server *pake_server, struct epk
     struct hkdf hkdf = { 0, {0} };
     ret = compute_hkdf((struct var_buffer *)&shared_secret, &pake_server->salt,
         HICHAIN_SPEKE_SESSIONKEY_INFO, HC_HKDF_SECRET_LEN, (struct var_buffer *)&hkdf);
+    (void)memset_s(&shared_secret, sizeof(struct pake_shared_secret), 0, sizeof(struct pake_shared_secret));
     if (ret != HC_OK) {
         LOGE("Object %u generate hkdf failed, error code is %d", pake_server_sn(pake_server), ret);
         goto error;
@@ -384,6 +392,7 @@ static int32_t generate_session_key(struct pake_server *pake_server, struct epk
                    hkdf.hkdf + PAKE_SESSION_KEY_LENGTH, PAKE_HMAC_KEY_LENGTH);
     pake_server->session_key.length = PAKE_SESSION_KEY_LENGTH;
     pake_server->hmac_key.length = PAKE_HMAC_KEY_LENGTH;
+    (void)memset_s(&hkdf, sizeof(struct hkdf), 0, sizeof(struct hkdf));
     return HC_OK;
 
 error:
diff --git a/frameworks/deviceauth_lite/source/key_agreement/sts_client.c b/frameworks/deviceauth_lite/source/key_agreement/sts_client.c
index b2ff447..f2515f7 100755
--- a/frameworks/deviceauth_lite/source/key_agreement/sts_client.c
+++ b/frameworks/deviceauth_lite/source/key_agreement/sts_client.c
@@ -61,7 +61,9 @@ void destroy_sts_client(struct sts_client *handle)
         DBG_OUT("Destroy sts client object failed");
         return;
     }
-
+    (void)memset_s(&handle->self_private_key, sizeof(struct stsk), 0, sizeof(struct stsk));
+    (void)memset_s(&handle->session_key, sizeof(struct sts_session_key), 0, sizeof(struct sts_session_key));
+    (void)memset_s(&handle->service_key, sizeof(struct hc_session_key), 0, sizeof(struct hc_session_key));
     FREE(handle);
     DBG_OUT("FREE sts client object success");
 }
@@ -128,6 +130,7 @@ static int32_t parse_start_response_data(void *handle, void *data)
 
     ret = compute_hkdf((struct var_buffer *)&shared_secret, &sts_client->salt, HICHAIN_AUTH_INFO,
                        STS_SESSION_KEY_LENGTH, (struct var_buffer *)&sts_client->session_key);
+    (void)memset_s(&shared_secret, sizeof(struct sts_shared_secret), 0, sizeof(struct sts_shared_secret));
     if (ret != HC_OK) {
         LOGE("Object %u compute_hkdf failed, error code is %d", sts_client_sn(sts_client), ret);
         return HC_STS_OBJECT_ERROR;
diff --git a/frameworks/deviceauth_lite/source/key_agreement/sts_server.c b/frameworks/deviceauth_lite/source/key_agreement/sts_server.c
index ccbb212..cb5a90b 100755
--- a/frameworks/deviceauth_lite/source/key_agreement/sts_server.c
+++ b/frameworks/deviceauth_lite/source/key_agreement/sts_server.c
@@ -67,7 +67,9 @@ void destroy_sts_server(struct sts_server *handle)
         DBG_OUT("Destroy sts server object failed");
         return;
     }
-
+    (void)memset_s(&handle->self_private_key, sizeof(struct stsk), 0, sizeof(struct stsk));
+    (void)memset_s(&handle->session_key, sizeof(struct sts_session_key), 0, sizeof(struct sts_session_key));
+    (void)memset_s(&handle->service_key, sizeof(struct hc_session_key), 0, sizeof(struct hc_session_key));
     FREE(handle);
     LOGI("FREE sts server object success");
 }
@@ -206,6 +208,7 @@ static int32_t parse_start_request_data(void *handle, void *receive_data)
 
     ret = compute_hkdf((struct var_buffer *)&shared_secret, &sts_server->salt, HICHAIN_AUTH_INFO,
         STS_SESSION_KEY_LENGTH, (struct var_buffer *)&sts_server->session_key);
+    (void)memset_s(&shared_secret, sizeof(struct sts_shared_secret), 0, sizeof(struct sts_shared_secret));
     if (ret != HC_OK) {
         LOGE("Object %u compute_hkdf failed, error code is %d", sts_server_sn(sts_server), ret);
         return HC_COMPUTE_HKDF_FAILED;