When a value of homomorphic ciphertext c satisfies c=(1+N)m·(hN mod N2)r mod N2, decryption based on private key sk can be performed as follows: First, size k of the predetermined cyclic group is calculated based on value α of private key sk; and then k-exponentiation is performed on both sides of the calculation equation of homomorphic ciphertext c, to obtain ck=(1+N)km·(hN mod N2)rk mod N2=(1+N)km·[(hk)N mod N2]r mod N2. As described above, h is the generator of the predetermined cyclic group, and the size of the predetermined cyclic group is k, and therefore hk=h0=1. Therefore, the equation can be further converted into ck=(1+N)km mod N2=1+km·N mod N2. In this case,