A database system comprising: a determining part determining whether or not to conceal information to be registered in a database; a terminal device that, if the determining part determines that the information is to be concealed, generates N information fragments by secret-sharing the information, wherein the knowledge of the original data can be gained only if K fragments are collected, where K is a positive integer less than or equal to N, and sends the N information fragments to a system management device, where N is a predetermined positive integer; the system management device sending the N information fragments received from the terminal device to N different database devices; and the N database devices each storing respective one of N information fragments received from the system management device, the determining part is provided in the terminal device; the determining part determines whether or not to conceal all or part of a search condition for looking up in the database; if the determining part determines to conceal all or part of the search condition, the terminal device generates C search information fragments by secret-sharing all or part of the search condition and sends the C search information fragments to the system management device, where C is a positive integer between K, inclusive, and N, inclusive; the system management device sends the C search information fragments received from the terminal device to C different database devices; the C database devices find C information fragments that correspond to the C search information fragments; the system management device sends K information fragments among the C information fragments to the terminal device; the terminal device reconstructs original information on the basis of the received K information fragments; the terminal device comprises a query interpreting part that determines whether a query input to the terminal device is a data deletion process; the determining part determines whether or not the data deletion process involves a secure computation process for reconstructing fragments of secret-shared information and sends information required for the data deletion process to the N database devices through the system management device; and if the secure computation process is involved, the N database devices perform the secure computation process and delete information to be deleted. a determining part determining whether or not to conceal information to be registered in a database; a terminal device that, if the determining part determines that the information is to be concealed, generates N information fragments by secret-sharing the information, wherein the knowledge of the original data can be gained only if K fragments are collected, where K is a positive integer less than or equal to N, and sends the N information fragments to a system management device, where N is a predetermined positive integer; the system management device sending the N information fragments received from the terminal device to N different database devices; and the N database devices each storing respective one of N information fragments received from the system management device, the determining part is provided in the terminal device; the determining part determines whether or not to conceal all or part of a search condition for looking up in the database; if the determining part determines to conceal all or part of the search condition, the terminal device generates C search information fragments by secret-sharing all or part of the search condition and sends the C search information fragments to the system management device, where C is a positive integer between K, inclusive, and N, inclusive; the system management device sends the C search information fragments received from the terminal device to C different database devices; the C database devices find C information fragments that correspond to the C search information fragments; the system management device sends K information fragments among the C information fragments to the terminal device; the terminal device reconstructs original information on the basis of the received K information fragments; the terminal device comprises a query interpreting part that determines whether a query input to the terminal device is a data deletion process; the determining part determines whether or not the data deletion process involves a secure computation process for reconstructing fragments of secret-shared information and sends information required for the data deletion process to the N database devices through the system management device; and if the secure computation process is involved, the N database devices perform the secure computation process and delete information to be deleted.