We Claim:
[Claim 1] A registration destination determination device, comprising:
a registration destination determination section to determine which data management device, among a plurality of data management devices, is to manage registration data, such that, with a data type constituting the registration data as a target type, an appearance frequency distribution of values set for the target type of the registration data managed by each of the plurality of data management devices is different from an appearance frequency distribution of values set for the target type of the registration data managed by the plurality of data management devices.
[Claim 2] The registration destination determination device according to claim 1,
wherein the registration destination determination section selects each data management device with a different probability for each value set for the target type, to determine which data management device is to manage the registration data.
[Claim 3] The registration destination determination device according to claim 2, further comprising:
a determination information storage section to store a selection probability for selecting each of the plurality of data management devices for each value set for the target type,
wherein the registration destination determination section selects a data management device according to the selection probability stored in the determination information storage section. [Claim 4] The registration destination determination device according to claim 2,

wherein the registration destination determination section calculates a selection probability of selecting each of the plurality of data management devices from the registration data and confidential information, and selects a data management device according to the calculated selection probability.
[Claim 5] The registration destination determination device according to any one of claims 1 to 4,
wherein the registration data is a keyword for searchable encryption.
[Claim 6] A registration device, comprising:
a registration destination determination device according to claim 5; and a transmission section to transmit the registration data to a data management
device that is determined to manage the registration data by the registration destination
determination device.
[Claim 7] A searchable encryption system, comprising:
a registration device according to claim 6;
the plurality of data management devices; and
a retrieval device to transmit a retrieval request to the plurality of data management devices so as to specify a keyword corresponding to the transmitted retrieval request.
[Claim 8] A registration destination determination method comprising:
determining which data management device, among a plurality of data management devices, is to manage registration data, such that, with a data type

constituting the registration data as a target type, an appearance frequency distribution of values set for the target type of the registration data managed by each of the plurality of data management devices is different from an appearance frequency distribution of values set for the target type of the registration data managed by the plurality of data management devices, by a computer.
[Claim 9] A registration destination determination program to cause a computer to execute:
registration destination determination processing to determine which data management device, among a plurality of data management devices, is to manage registration data, such that, with a data type constituting the registration data as a target type, an appearance frequency distribution of values set for the target type of the registration data managed by each of the plurality of data management devices is different from an appearance frequency distribution of values set for the target type of the registration data managed by the plurality of data management devices.