Institut Luxembourgeois de Régulation - Règlement ILR/T18/12 du 5 décembre 2018 fixant le protocole et l’interface sécurisés ainsi que le format d’échange à utiliser pour le transfert des données à fournir par les entreprises notifiées en vertu de l’article 10bis de la loi modifiée du 30 mai 2005 concernant la protection de la vie privée dans le secteur des communications électroniques - Secteur (rilr_2018_12_05_a1105) | LU

Institut Luxembourgeois de Régulation - Règlement ILR/T18/12 du 5 décembre 2018 fixant le protocole et l’interface sécurisés ainsi que le format d’échange à utiliser pour le transfert des données à fournir par les entreprises notifiées en vertu de l’article 10bis de la loi modifiée du 30 mai 2005 concernant la protection de la vie privée dans le secteur des communications électroniques - Secteur

Art. 0 (préambule) — Institut Luxembourgeois de Régulation - Règlement ILR/T18/12 du 5 décembre 2018 fixant le protocole et l’interface sécurisés ainsi que le format d’échange à utiliser pour le transfert des données à fournir par les entreprises notifiées en vertu de l’article 10bis de la loi modifiée du 30 mai 2005 concernant la protection de la vie privée dans le secteur des communications électroniques - Secteur Ouvrir la source officielle

DU GRAND-DUCHÉ DE LUXEMBOURG

N° 1105 du 7 décembre 2018

Institut Luxembourgeois de Régulation - Règlement ILR/T18/12 du 5 décembre 2018 fixant le protocole

et l’interface sécurisés ainsi que le format d’échange à utiliser pour le transfert des données à fournir

par les entreprises notifiées en vertu de l’article 10bis de la loi modifiée du 30 mai 2005 concernant

la protection de la vie privée dans le secteur des communications électroniques - Secteur

communications électroniques.

La Direction de l’Institut Luxembourgeois de Régulation,

Vu la loi modifiée du 30 mai 2005 concernant la protection de la vie privée dans le secteur des communications

électroniques et notamment son article 10bis ;

Arrête

Institut Luxembourgeois de Régulation - Règlement ILR/T18/12 du 5 décembre 2018 fixant le protocole et l’interface sécurisés ainsi que le format d’échange à utiliser pour le transfert des données à fournir par les entreprises notifiées en vertu de l’article 10bis de la loi modifiée du 30 mai 2005 co

Art. 1 — Institut Luxembourgeois de Régulation - Règlement ILR/T18/12 du 5 décembre 2018 fixant le protocole et l’interface sécurisés ainsi que le format d’échange à utiliser pour le transfert des données à fournir par les entreprises notifiées en vertu de l’article 10bis de la loi modifiée du 30 mai 2005 co Ouvrir la source officielle

Le présent règlement et ses annexes qui en font partie intégrante fixent le protocole et l’interface sécurisés

ainsi que le format d’échange à utiliser pour le transfert des données à fournir, en vertu de l’article 10bis (2)

de la loi modifiée du 30 mai 2005 concernant la protection de la vie privée dans le secteur des communica

tions électroniques, par les entreprises notifiées auprès de l’Institut conformément à la loi modifiée du 27

février 2011 sur les réseaux et les services de communications électroniques qui fournissent un service de

communications électroniques accessible au public en ayant recours à des ressources de numérotation

luxembourgeois (ci-après « notified operators »).

Institut Luxembourgeois de Régulation - Règlement ILR/T18/12 du 5 décembre 2018 fixant le protocole et l’interface sécurisés ainsi que le format d’échange à utiliser pour le transfert des données à fournir par les entreprises notifiées en vertu de l’article 10bis de la loi modifiée du 30 mai 2005 co

Art. 2 — Institut Luxembourgeois de Régulation - Règlement ILR/T18/12 du 5 décembre 2018 fixant le protocole et l’interface sécurisés ainsi que le format d’échange à utiliser pour le transfert des données à fournir par les entreprises notifiées en vertu de l’article 10bis de la loi modifiée du 30 mai 2005 co Ouvrir la source officielle

Le présent règlement sera publié au Journal officiel du Grand-Duché de Luxembourg et sur le site Internet

de l’Institut.

Pour l’Institut Luxembourgeois de Régulation,

La Direction,

Luc Tapella

Directeur

Camille Hierzig

Directeur adjoint

Michèle Bram

Directrice adjointe

JOURNAL OFFICIEL du Grand-Duché de Luxembourg

MÉMORIAL A - 1105 du 7 décembre 2018

ANNEXE 1

TECHNICAL DOCUMENT FOR OPERATOR WEB SERVICES

Purpose of the document

The purpose of this document is to describe the Web Service published by the IR.COM system

for the notified operator.

Reference Documents

Ref.

Title

Version

Date

R01

ISO 3166-1 alpha-3 code

2013-1

15/11/2013

R02

Web Services Security X.509 Certificate Token Profile

1.1.1

18/05/2012

R03

WS-SecurityPolicy

1.2

01/07/2007

Table 1 : Reference documents

JOURNAL OFFICIEL du Grand-Duché de Luxembourg

MÉMORIAL A - 1105 du 7 décembre 2018

Abbreviation and Acronyms

Abbreviation

Definition

ILR

Institut Luxembourgeois de Régulation

JAX-WS

Java API for XML-Based Web Services

SOAP

Simple Object Access Protocol

XSD

XML Schema Definition

WSDL

Web Services Description Language

Table 2 : Abbreviations and Acronyms

JOURNAL OFFICIEL du Grand-Duché de Luxembourg

MÉMORIAL A - 1105 du 7 décembre 2018

TABLE OF CONTENTS

INTRODUCTION .......................................................................................................................................... 5

1.1

PURPOSE OF THE DOCUMENT .......................................................................................................... 5

1.2

STRUCTURE OF THE DOCUMENT ...................................................................................................... 5

1.3

KEY WORDS ...................................................................................................................................... 5

ARCHITECTURE ......................................................................................................................................... 6

WEB SERVICE INTERFACE ........................................................................................................................ 7

3.1

ENCODING ......................................................................................................................................... 8

3.2

DEFINITION OF THE OPERATION ....................................................................................................... 8

3.2.1

sendReport ............................................................................................................................. 8

3.2.2

Example request ................................................................................................................... 8

3.2.3

Example response ................................................................................................................ 9

XSD ......................................................................................................................................................... 10

4.1

SENDREPORTINPUT_TYPE ............................................................................................................ 10

4.2

SENDREPORTOUTPUT_TYPE ........................................................................................................ 10

4.3

REPORT_TYPE ................................................................................................................................ 11

4.4

OPERATOR_TYPE ........................................................................................................................... 11

4.5

RELATIONS_TYPE .......................................................................................................................... 11

4.6

RELATION_TYPE ............................................................................................................................. 12

4.7

NATURALPERSON_TYPE ............................................................................................................... 12

4.8

LEGALPERSON_TYPE .................................................................................................................... 13

4.9

SERVICE_TYPE ............................................................................................................................... 14

4.10

NATURE_TYPE ................................................................................................................................ 14

4.11

ADDRESS_TYPE ............................................................................................................................. 15

4.12

NUMBER_TYPE ............................................................................................................................... 16

4.13

IDDOCUMENT_TYPE ....................................................................................................................... 16

4.14

ISOCOUNTRY_TYPE ....................................................................................................................... 17

4.15

SENDREPORTOUTPUT_TYPE ........................................................................................................ 17

SECURITY................................................................................................................................................. 18

5.1

AUTHENTICATION ............................................................................................................................ 18

JOURNAL OFFICIEL du Grand-Duché de Luxembourg

MÉMORIAL A - 1105 du 7 décembre 2018

LIST OF TABLES

Table 1: Reference Documents ........................................................................................................................ 1

Table 2: Abbreviations and Acronyms ............................................................................................................... 2

LIST OF FIGURES

Figure 1: System Overview ............................................................................................................................... 6

Figure 2: WS client class diagram ..................................................................................................................... 7

JOURNAL OFFICIEL du Grand-Duché de Luxembourg

MÉMORIAL A - 1105 du 7 décembre 2018

INTRODUCTION

The chapter introduces the document by its purpose, audience and structure.

1.1 PURPOSE OF THE DOCUMENT

The purpose of this document is to describe the Web Service published by the IR.COM system for the

notified operator.

1.2 STRUCTURE OF THE DOCUMENT

The document is organized as follows

Section 1 “Introduction” is the current section;

Section 2 “Architecture”, an overview of the Web Service;

Section 3 “Web service interface”, definition of the service and the operation: it presents the

operations and interfaces defined;

Section 4 “XSD”, provides a detailed description of the XML schema of the Web Service;

Section 5 “Security” provides a detailed description of the security.

1.3 KEY WORDS

The key words “MUST”, “MUST NOT”, “REQUIRED”, “SHALL”, “SHALL NOT”, “SHOULD”, “SHOULD NOT”,

“RECOMMENDED”, “MAY”, and “OPTIONAL” in this document are to be interpreted as described in RFC

2119. The key word "CONDITIONAL" is to be interpreted as follows

CONDITIONAL: The usage of an item is dependent on the usage of other items. It is therefore further qualified

under which conditions the item is REQUIRED or RECOMMENDED.

JOURNAL OFFICIEL du Grand-Duché de Luxembourg

MÉMORIAL A - 1105 du 7 décembre 2018

2 ARCHITECTURE

Figure 1: System Overview

Figure 1 shows a global diagram of the communication between the Web Service located on the CTIE

servers and the Web Service clients located in the notified operators' infrastructures.

The security is addressed by the WS-Security standard which aims at protecting the integrity and the

confidentiality of a message and authenticating the sender.

JOURNAL OFFICIEL du Grand-Duché de Luxembourg

MÉMORIAL A - 1105 du 7 décembre 2018

3 WEB SERVICE INTERFACE

This chapter presents the Web Service schema.

Figure 2: WS client class diagram

In order to interact with the Web Service, WS clients MUST proceed with the following steps

Create a new instance of the OperatorType class and add it to the newly created Report;

For each subscriber, create a new instance of the RelationType class and add

o

A new instance of the ServiceType class

JOURNAL OFFICIEL du Grand-Duché de Luxembourg

MÉMORIAL A - 1105 du 7 décembre 2018



A new instance of the NatureType class has to be created to reflect the nature of the

service provided (Fixed, Mobile, Prepaid).

o

Depending on the type of subscriber



A new instance of the NaturalPersonType class

If the Service provided is a prepaid one, a new instance of the

IdDocumentType class MUST be provided. A new instance of the

DocumentType class MUST also be specified with one of the enumerated

value (Id Card, Passport, Residence permit or Certificate of filing an

application for international protection).



A new instance of the LegalPersonType class.

o

A new instance of the AddressType class and add it to the corresponding subscriber.

Create a new instance of the RelationsType class and add all the newly created relations;

Create a new instance of the ReportType class and add the OperatorType instance and the

RelationsType instance.

3.1 ENCODING

The default encoding MUST be UTF-8 for all the alphanumerical values.

3.2 DEFINITION OF THE OPERATION

This chapter describes the operations and interfaces to interact with the system.

3.2.1 sendReport

sendReport

Direction

Parameter

Description

Required

Request

report

A report for an operator

Yes

Response

resultMessage The result message

No

resultCode

The execution result code

Yes

The operation has SUCCEEDED,

the report can be processed.

-1

The operation has FAILED, the

report WILL NOT be processed

3.2.2 Example request

<?xml version="1.0" encoding="UTF-8" standalone="yes"?>

<ns2:sendReportInput xmlns:ns2="http://ver1.operator.services.com.ir.etat.lu">

</operator>

<lastname>Lastname</lastname>

<firstname>Firstname</firstname>

<birthplace>BirthPlace</birthplace>

<type>PASSPORT</type>

</idDocument>

JOURNAL OFFICIEL du Grand-Duché de Luxembourg

MÉMORIAL A - 1105 du 7 décembre 2018

<street>Street</street>

<locality>Locality</locality>

</placeOfResidence>

</naturalPerson>

<nature>FIXED</nature>

</service>

</relation>

<street>Street 1</street>

<locality>Locality1</locality>

</establishmentPlace>

</legalPerson>

</service>

</relation>

</relations>

</report>

</ns2:sendReportInput>

3.2.3 Example response

<?xml version="1.0" encoding="UTF-8" standalone="yes"?>

<ns2:sendReportOutput xmlns:ns2="http://ver1.operator.services.com.ir.etat.lu">

<resultMessage>Result message</resultMessage>

</ns2:sendReportOutput>

JOURNAL OFFICIEL du Grand-Duché de Luxembourg

MÉMORIAL A - 1105 du 7 décembre 2018

4 XSD

4.1 SENDREPORTINPUT_TYPE

Input composed of report.

The following schema fragments specifies the expected content.

<element name="report"

type="{http://ver1.operator.services.com.ir.etat.lu}report_Type" />

</sequence>

</restriction>

</complexContent>

</complexType>

Namespace

http://ver1.operator.services.com.ir.etat.lu

Properties

Name

Data type

Min/max occurs

report

report_Type

1/1

4.2 SENDREPORTOUTPUT_TYPE

Output wrapper type, composed of a result code and a result message.

The following schema fragment specifies the expected content.

<element name="resultCode"

type="{http://www.w3.org/2001/XMLSchema}int" />

<element name="resultMessage"

type="{http://www.w3.org/2001/XMLSchema}string" />

</sequence>

</restriction>

</complexContent>

</complexType>

Namespace

http://ver1.operator.services.com.ir.etat.lu

Properties

Name

Data type

Min/max occurs

resultCode

int

1/1

resultMessage

string

1/1

JOURNAL OFFICIEL du Grand-Duché de Luxembourg

MÉMORIAL A - 1105 du 7 décembre 2018

4.3 REPORT_TYPE

Composed of the information of the operator and its customers list.

The following schema fragment specifies the expected content.

<element name="operator"

type="{http://ver1.operator.services.com.ir.etat.lu}operator_Type" />

<element name="relations"

type="{http://ver1.operator.services.com.ir.etat.lu}relations_Type" />

</sequence>

</restriction>

</complexContent>

</complexType>

Namespace

http://ver1.operator.services.com.ir.etat.lu

Properties

Name

Data type

Min/max occurs

operator

operator_Type

1/1

relations

relations_Type

1/1

4.4 OPERATOR_TYPE

Information on the operator.

The following schema fragment specifies the expected content.

<element name="identifier"

type="{http://ver1.common.operator.com.ir.etat.lu}max50String_Type" />

</sequence>

</restriction>

</complexContent>

</complexType>

Namespace

http://ver1.operator.services.com.ir.etat.lu

Properties

Name

Data type

Min/max occurs

Identifier

string

1/1

4.5 RELATIONS_TYPE

A list of customer / service relations.

The following schema fragment specifies the expected content.

JOURNAL OFFICIEL du Grand-Duché de Luxembourg

MÉMORIAL A - 1105 du 7 décembre 2018

<element name="relation"

type="{http://ver1.operator.services.com.ir.etat.lu}relation_Type"

minOccurs="0"

maxOccurs="unbounded" />

</sequence>

</restriction>

</complexContent>

</complexType>

Namespace

http://ver1.operator.services.com.ir.etat.lu

Properties

Name

Data type

Min/max occurs

Relation

list of relation_Type

0/unbounded

4.6 RELATION_TYPE

The relation type.

The following schema fragment specifies the expected content.

<element name="naturalPerson"

type="{http://ver1.common.operator.com.ir.etat.lu}naturalPerson_Type" />

<element name="legalPerson"

type="{http://ver1.common.operator.com.ir.etat.lu}legalPerson_Type" />

</choice>

<element name="service"

type="{http://ver1.operator.services.com.ir.etat.lu}service_Type" />

</sequence>

</restriction>

</complexContent>

</complexType>

Namespace

http://ver1.operator.services.com.ir.etat.lu

Properties

Name

Data type

Min/max occurs

naturalPerson

naturalPerson_Type

0/1

legalPerson

legalPerson_Type

0/1

service

service_Type

1/1

4.7 NATURALPERSON_TYPE

Natural person type.

The following schema fragment specifies the expected content.

<element name="lastname"

JOURNAL OFFICIEL du Grand-Duché de Luxembourg

MÉMORIAL A - 1105 du 7 décembre 2018

type="{http://ver1.common.operator.com.ir.etat.lu}max100String_Type" />

<element name="firstname"

type="{http://ver1.common.operator.com.ir.etat.lu}max100String_Type" />

<element name="birthdate"

type="{http://www.w3.org/2001/XMLSchema}date" />

<element name="birthplace"

type="{http://ver1.common.operator.com.ir.etat.lu}max100String_Type" />

<element name="birthcountry"

type="{http://ver1.country.operator.com.ir.etat.lu}isoCountry_Type" />

<element name="idDocument"

type="{http://ver1.common.operator.com.ir.etat.lu}idDocument_Type"

minOccurs="0" />

<element name="placeOfResidence"

type="{http://ver1.common.operator.com.ir.etat.lu}address_Type" />

<element name="contactNumber"

type="{http://ver1.common.operator.com.ir.etat.lu}number_Type" />

</sequence>

</complexType>

Namespace

http://ver1.common.operator.com.ir.etat.lu

Properties

Name

Data type

Min/max occurs

lastname

string

1/1

firstname

string

1/1

birthdate

date

1/1

birthplace

string

1/1

birthcountry

isoCountry_Type

1/1

idDocument

idDocument _Type

0/1

placeOfResidence

address_Type

1/1

contactNumber

number_Type

1/1

4.8 LEGALPERSON_TYPE

Legal person type.

The following schema fragment specifies the expected content.

<element name="name"

type="{http://ver1.common.operator.com.ir.etat.lu}max100String_Type" />

<element name="establishmentPlace"

type="{http://ver1.common.operator.com.ir.etat.lu}address_Type" />

<element name="contactNumber"

type="{http://ver1.common.operator.com.ir.etat.lu}number_Type" />

</sequence>

</restriction>

</complexContent>

</complexType>

Namespace

JOURNAL OFFICIEL du Grand-Duché de Luxembourg

MÉMORIAL A - 1105 du 7 décembre 2018

http://ver1.common.operator.com.ir.etat.lu

Properties

Name

Data type

Min/max occurs

Name

string

1/1

establishmentPlace

address_Type

1/1

contactNumber

number_Type

1/1

4.9 SERVICE_TYPE

Subscribed service.

The following schema fragment specifies the expected content.

<element name="number"

type="{http://ver1.common.operator.com.ir.etat.lu}number_Type" />

<element name="nature"

type="{http://ver1.operator.services.com.ir.etat.lu}nature_Type" />

<element name="endDate"

type="{http://www.w3.org/2001/XMLSchema}date"

minOccurs="0" />

</sequence>

</restriction>

</complexContent>

</complexType>

Namespace

http://ver1.operator.services.com.ir.etat.lu

Properties

Name

Data type

Min/max occurs

number

number_Type

1/1

nature

nature_Type

1/1

endDate *

date

0/1

* Depending on the nature of the service, the endDate value can correspond to the contract end date or the

deactivation date of the number.

4.10 NATURE_TYPE

The nature type

The following schema fragment specifies the expected content.

</restriction>

</simpleType>

JOURNAL OFFICIEL du Grand-Duché de Luxembourg

MÉMORIAL A - 1105 du 7 décembre 2018

Namespace

http://ver1.operator.services.com.ir.etat.lu

Values

Value

Description

FIXED

Fixed phone service

MOBILE

Mobile phone service

PREPAID

Prepaid phone service

4.11 ADDRESS_TYPE

The address of the person.

The following schema fragment specifies the expected content.

<element name="number"

type="{http://ver1.common.operator.com.ir.etat.lu}max10String_Type"

minOccurs="0" />

<element name="street"

type="{http://ver1.common.operator.com.ir.etat.lu}max50String_Type" />

<element name="city"

type="{http://ver1.common.operator.com.ir.etat.lu}max50String_Type" />

<element name="locality"

type="{http://ver1.common.operator.com.ir.etat.lu}max50String_Type" />

<element name="zipCode"

type="{http://ver1.common.operator.com.ir.etat.lu}max10String_Type" />

<element name="country"

type="{http://ver1.country.operator.com.ir.etat.lu}isoCountry_Type" />

</sequence>

</restriction>

</complexContent>

</complexType>

Namespace

http://ver1.common.operator.com.ir.etat.lu

Properties

Name

Data type

Min/max occurs

number

string

0/1

street

string

1/1

city

string

1/1

locality

string

1/1

zipCode

string

1/1

country

isoCountry_Type

1/1

JOURNAL OFFICIEL du Grand-Duché de Luxembourg

MÉMORIAL A - 1105 du 7 décembre 2018

4.12 NUMBER_TYPE

The phone number format type.

The following schema fragment specifies the expected content.

</restriction>

</simpleType>

Namespace

http://ver1.common.operator.com.ir.etat.lu

Values MUST follow the pattern “[0_9]{17}”.

4.13 IDDOCUMENT_TYPE

The IdDocument type.

The following schema fragment specifies the expected content.

<element name="number"

type="{http://ver1.common.operator.com.ir.etat.lu}max50String_Type" />

<element name="type"

type="{http://ver1.common.operator.com.ir.etat.lu}document_Type" />

<element name="country"

type="{http://ver1.country.operator.com.ir.etat.lu}isoCountry_Type" />

</sequence>

</restriction>

</complexContent>

</complexType>

Namespace

http://ver1.common.operator.com.ir.etat.lu

Properties

Name

Data type

Min/max occurs

number

string

1/1

type

document_Type (Enumeration.

Values will be provided in the

XSD definition)

1/1

country

isoCountry_Type

1/1

JOURNAL OFFICIEL du Grand-Duché de Luxembourg

MÉMORIAL A - 1105 du 7 décembre 2018

4.14 ISOCOUNTRY_TYPE

The ISO 3166-1 alpha-3 country code type

The following schema fragment specifies the expected content.

…..

</restriction>

</simpleType>

Namespace

http://ver1.country.operator.com.ir.etat.lu

Values are values from the ISO 3166-1 alpha-3 standard ([R01])

4.15 SENDREPORTOUTPUT_TYPE

Output composed of a result code and a result message.

The following schema fragment specifies the expected content.

<element name="resultCode"

type="{http://www.w3.org/2001/XMLSchema}int" />

<element name="resultMessage"

type="{http://www.w3.org/2001/XMLSchema}string" />

</sequence>

</restriction>

</complexContent>

</complexType>

Namespace

http://ver1.operator.services.com.ir.etat.lu

Properties

Name

Data type

Min/max occurs

resultCode

int

1/1

resultMessage

string

1/1

JOURNAL OFFICIEL du Grand-Duché de Luxembourg

MÉMORIAL A - 1105 du 7 décembre 2018

SECURITY

The security of the Web Services relies on two different mechanisms

Protocol related: all access to the Web Services MUST be done using HTTPS.

Application related: the WS-Security standards MUST be used by the client to send trusted user

information to the server.

5.1 AUTHENTICATION

The authentication with WS services will be handled by WS-Security ([R02]).

A BinarySecurityToken element MUST be added to the header of the SOAP message. This

BinarySecurityToken contains the X509v3 certificate used for signing.

A Timestamp <wsu:Timestamp> element MUST be present with the creation date <wsu:Created> and the

expiration date <wsu:Expires>.

The following elements MUST be signed with the X509v3 certificate of the BinarySecurityToken

TimeStamp element of the SOAP header;

The SOAP body.

The encoding algorithms used MUST be Basic256Sha256 ([R03]).

<soapenv:Envelope>

<soapenv:Header>

<wsse:Security

xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd"

xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd">

<wsse:BinarySecurityToken

EncodingType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-

1.0#Base64Binary"

ValueType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509v3"

wsu:Id="X509-123">

MIIETjCCAzagAwIBAgIBBzANBgkqhkiG9w0BAQsFADBBMQswCQYDVQQGEwJMVTENMAsGA1UEChMERVR

…

XtDMtkFkqydAcmwi/2mOazJ9fZAcZNwFgG2gOTl4ApkpzZWj8hTHPwh+NPlPIZXKtHxV9YsOamBif39k=

</wsse:BinarySecurityToken>

<ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#">

<ds:SignedInfo>...</ds:SignedInfo>

<ds:SignatureValue>...</ds:SignatureValue>

<ds:KeyInfo>...</ds:KeyInfo>

</ds:Signature>

<wsu:Timestamp wsu:Id="TS-123">

<wsu:Created>2017-12-05T15:19:24Z</wsu:Created>

<wsu:Expires>2017-12-05T15:24:24Z</wsu:Expires>

</wsu:Timestamp>

</wsse:Security>

</soapenv:Header>

</soapenv:Envelope>

The call to the Web Service provider is done by sending the previous message. This transfer is secured via

the SSL protocol.

The application receives the message and checks if the XML SOAP message has not been modified and if

the access to the Web Service is allowed for the calling application

Using the public key, the XML-Signature is verified.

The application executes the method of the Web Service and returns the result which is secured by SSL.

JOURNAL OFFICIEL du Grand-Duché de Luxembourg

MÉMORIAL A - 1105 du 7 décembre 2018

ANNEXE 2

TECHNICAL

DOCUMENT

FOR

CSV

FILE

FORMAT

FOR

NOTIFIED

OPERATORS

Purpose of the document

The purpose of this document is to describe the format of the CSV file mainly used for the initial

upload of data in the IR.COM system for the notified operators.

Reference Documents

Ref.

Title

Version

Date

R01

RFC4180 - Common Format and MIME Type

for Comma-Separated Values (CSV) Files

01/10/2005

R02

ISO 3166-1 alpha-3 code

2013-1

15/11/2013

Table 1 : Reference documents

Abbreviation and Acronyms

Abbreviation

Definition

CSV

Comma-Separated Value

ILR

Institut Luxembourgeois de Régulation

Table 2 Abbreviations and Acronyms

JOURNAL OFFICIEL du Grand-Duché de Luxembourg

MÉMORIAL A - 1105 du 7 décembre 2018

TABLE OF CONTENTS

INTRODUCTION .......................................................................................................................................... 3

1.1

PURPOSE OF THE DOCUMENT .......................................................................................................... 3

1.2

STRUCTURE OF THE DOCUMENT ...................................................................................................... 3

1.3

KEY WORDS ...................................................................................................................................... 3

CSV FILE FORMAT .................................................................................................................................... 4

2.1

CSV FILENAME RULES ..................................................................................................................... 4

2.2

CSV FILE RULES .............................................................................................................................. 4

2.3

CSV FILE STRUCTURE ..................................................................................................................... 4

2.3.1

FIELD SEPARATOR ........................................................................................................................ 4

2.3.2

HEADER FORMAT .......................................................................................................................... 4

2.3.3

ROW FORMAT ................................................................................................................................ 4

EXAMPLES ................................................................................................................................................. 6

3.1

NATURAL PERSON ............................................................................................................................ 6

3.2

LEGAL PERSON ................................................................................................................................ 7

LIST OF TABLES

Table 1 : Reference documents ........................................................................................................................ 1

Table 2 : Abbreviations and Acronyms .............................................................................................................. 1

Table 3 : CSV row format .................................................................................................................................. 5

Table 4 : CSV values for a Natural Person........................................................................................................ 6

Table 5 : CSV values for a Legal Person .......................................................................................................... 7

JOURNAL OFFICIEL du Grand-Duché de Luxembourg

MÉMORIAL A - 1105 du 7 décembre 2018

INTRODUCTION

The chapter introduces the document by its purpose, audience and structure.

1.1

PURPOSE OF THE DOCUMENT

The purpose of this document is to describe the format of the CSV ([R01]) file mainly used for the initial

upload of data in the IR.COM system for the notified operators.

1.2

STRUCTURE OF THE DOCUMENT

The document is organized as follows

Section 1 “Introduction” is the current section;

Section 2 “CSV file format”, the definition of the filename convention, the file format and the structure

of the file to use.

1.3

KEY WORDS

The key words “MUST”, “MUST NOT”, “REQUIRED”, “SHALL”, “SHALL NOT”, “SHOULD”, “SHOULD NOT”,

“RECOMMENDED”, “MAY”, and “OPTIONAL” in this document are to be interpreted as described in RFC

2119. The key word "CONDITIONAL" is to be interpreted as follows

CONDITIONAL: The usage of an item is dependent on the usage of other items. It is therefore further qualified

under which conditions the item is REQUIRED or RECOMMENDED.

JOURNAL OFFICIEL du Grand-Duché de Luxembourg

MÉMORIAL A - 1105 du 7 décembre 2018

2 CSV FILE FORMAT

2.1

CSV FILENAME RULES

In order to be correctly handled and processed by the system, the received CSV files MUST be named

regarding the requirements below

The file type extension MUST be set to “.csv”;

The file names MUST NOT include whitespaces;

2.2

CSV FILE RULES

The following rules apply regarding the content of the files

The character set used by the data contained in the file MUST be UTF-8;

No binary data MUST be transported in the CSV file;

A CSV file MUST contain at least the header line.

o

In the case of an empty daily report, the CSV file MUST contain only the header line.

The End of Record MUST be set to CR+LF (i.e. Carriage Return and Line Feed).

2.3

CSV FILE STRUCTURE

This section describes the different principles to follow in order to produce a valid CSV file for the import

process of subscribers’ data to the IR.COM system.

Execpt the first line of the file which contains the headers, each line of the file represents one subscriber record

and is terminated by any valid new Line feed (Carriage Return (CR) ASCII (13) and Line Feed (LF) ASCII (10))

2.3.1 FIELD SEPARATOR

The field separator to use is “@@”. This value ensures that the separator can not be present in a value of

the file.

2.3.2 HEADER FORMAT

The header row MUST be strictly as follow

Service_Number@@Service_End_Date@@Service_Nature@@Person_Type@@Person_Name@@Perso

n_Firstname@@Person_Birthdate@@Person_Birthplace@@Person_Birthcountry@@Contact_Number@

@Address_Number@@Address_Street@@Address_City@@Address_Locality@@Address_ZipCode@@A

ddress_Country@@IdDocument_Number@@IdDocument_Type@@IdDocument_Country

2.3.3 ROW FORMAT

Name

Format

Description

Service_Number

Numeric value

Pattern : [0-9]{1,17}

The subscribed service number.

Service_End_Date

Date

Format YYYY-MM-DD

Depending on the nature of the service, the contract

end date or the deactivation date of the number.

Service_Nature

Enumeration

FIXED

MOBILE

PREPAID

The Subscribed service nature.

FIXED corresponds to a Fixed phone

service

MOBILE corresponds to a Mobile phone

service

PREPAID corresponds to a Prepaid

phone service

Person_Type

Enumeration

The type of the person

JOURNAL OFFICIEL du Grand-Duché de Luxembourg

MÉMORIAL A - 1105 du 7 décembre 2018

NATURAL

LEGAL

NATURAL corresponds to a natural

person

LEGAL corresponds to a legal person

Person_Name

Alphanumeric value (UTF-8)

Minimum size : 1

Maximum size : 100

The lastname of the Natural person.

The name for a Legal person.

Person_Firstname

Alphanumeric value (UTF-8)

Minimum size : 1

Maximum size : 100

The firstname of the Natural person.

Empty for a Legal person.

Person_Birthdate

Date

Format YYYY-MM-DD

The birth date of the Natural person.

Empty for a Legal person.

Person_Birthplace

Alphanumeric value (UTF-8)

Minimum size : 1

Maximum size : 100

The birth place of the Natural person.

Empty for a Legal person.

Person_Birthcountry

Enumeration

ISO 3166-1 alpha-3 list ([R02])

The birth country of the Natural person.

Empty for a Legal person.

Contact_Number

Numeric value

Pattern : [0-9]{1,17}

Contact number of the person

Address_Number

Alphanumeric value (UTF-8)

Minimum size : 0

Maximum size : 10

Street number of the address

Address_Street

Alphanumeric value (UTF-8)

Minimum size : 1

Maximum size : 50

Street of the address

Address_City

Alphanumeric value (UTF-8)

Minimum size : 1

Maximum size : 50

City of the address

Address_Locality

Alphanumeric value (UTF-8)

Minimum size : 1

Maximum size : 50

Locality of the address

Address_ZipCode

Alphanumeric value (UTF-8)

Minimum size : 1

Maximum size : 10

Zipcode of the address

Address_Country

Enumeration

ISO 3166-1 alpha-3 list ([R02])

Country of the address.

IdDocument_Number

Alphanumeric value (UTF-8)

Minimum size : 1

Maximum size : 50

Number of the ID document

Empty for Legal person

IdDocument_Type

Enumeration

Values will be provided by the ILR.

Empty for a Legal person

IdDocument_Country

Enumeration

ISO 3166-1 alpha-3 list ([R02])

Country of delivery of the ID document

Empty for a Legal person

Table 3 : CSV row format

JOURNAL OFFICIEL du Grand-Duché de Luxembourg

MÉMORIAL A - 1105 du 7 décembre 2018

3 EXAMPLES

3.1

NATURAL PERSON

Hereafter the expected CSV record for a natural person whose information is provided in [table 4]

123456789@@2019-12-31@@FIXED@@NATURAL@@Smith@@John@@1975-07-

01@@Paris@@FRA@@123198465@@5B@@Rue de l'Abattoir@@Luxembourg@@Luxembourg@@L-

1111@@LUX@@12345679@@PASSPORT@@LUX

Name

Value

Service_Number

123456789

Service_End_Date

2019-12-31

Service_Nature

FIXED

Person_Type

NATURAL

Person_Name

Smith

Person_Firstname

John

Person_Birthdate

1975-07-01

Person_Birthplace

Paris

Person_Birthcountry

FRA

Contact_Number

123198465

Address_Number

5B

Address_Street

Rue de l'Abattoir

Address_City

Address_Locality

Address_ZipCode

L-1111

Address_Country

LUX

IdDocument_Number

12345679

IdDocument_Type

PASSPORT

IdDocument_Country

LUX

Table 4 : CSV values for a Natural Person

JOURNAL OFFICIEL du Grand-Duché de Luxembourg

MÉMORIAL A - 1105 du 7 décembre 2018

3.2

LEGAL PERSON

Hereafter the expected CSV record for a legal person and the corresponding information in [table 5]

123456789@@@@FIXED@@LEGAL@@World cie@@@@@@@@@@123198465@@2@@Rue Albert

1er@@Luxembourg@@Luxembourg@@L-1117@@LUX@@@@@@

Name

Value

Service_Number

123456789

Service_End_Date

2019-12-31

Service_Nature

FIXED

Person_Type

LEGAL

Person_Name

World cie

Person_Firstname

Person_Birthdate

Person_Birthplace

Person_Birthcountry

Contact_Number

123198465

Address_Number

Address_Street

Rue Albert 1er

Address_City

Address_Locality

Address_ZipCode

L-1117

Address_Country

LUX

IdDocument_Number

IdDocument_Type

IdDocument_Country

Table 5 : CSV values for a Legal Person

JOURNAL OFFICIEL du Grand-Duché de Luxembourg

MÉMORIAL A - 1105 du 7 décembre 2018

ANNEXE 3

TERMS AND CONDITIONS OF THE SERVICE OF DATA TRANSFER

Purpose of the document

The purpose of this document is to describe the terms and conditions of the service of data

transfer.

Abbreviation and Acronyms

Abbreviation

Definition

CTIE

Centre des technologies de l’information de l’État

IT

Information Technologies

Table 1 : Abbreviations and Acronyms

JOURNAL OFFICIEL du Grand-Duché de Luxembourg

MÉMORIAL A - 1105 du 7 décembre 2018

TABLE OF CONTENTS

INFORMATION SECURITY .......................................................................................................................... 3

1.1

INFORMATION SECURITY FRAMEWORK ................................................................................................ 3

1.2

ACCESS CONTROL ................................................................................................................................ 3

SERVICE MANAGEMENT ............................................................................................................................ 4

2.1

SERVICE MANAGER .............................................................................................................................. 4

2.2

SERVICE LIFECYCLE ............................................................................................................................. 4

2.3

SUSPENSION OR MODIFICATION OF THE SERVICE .............................................................................. 4

2.4

INCIDENT MANAGEMENT PROCEDURE ................................................................................................. 4

LIABILITIES OF USE OF THE SERVICE ...................................................................................................... 4

LIST OF TABLES

Table 1 : Abbreviations and Acronyms .............................................................................................................. 1

JOURNAL OFFICIEL du Grand-Duché de Luxembourg

MÉMORIAL A - 1105 du 7 décembre 2018

In order to use the service of data transfer implemented in the context of the article 10bis of the modified law

of the 30th May 2005 regarding the protection of privacy in the electronic communications sector (hereafter

“the Service”), the notified operators shall conform to the following obligations

1 INFORMATION SECURITY

1.1 INFORMATION SECURITY FRAMEWORK

As the exchange of information performed via the Service contains confidential and personal data, the

confidentiality, integrity and authenticity of the information exchange can only be ensured by appropriate

information security measures.

The notified operators commit to respect the following requirements in their respective information security

processes

Information security policy

o

Establish an information security policy which includes such fundamental aspects as the

assignment of roles and responsibilities, a risk management process and an asset

management process allowing to set and maintain an inventory of the information systems

using the Service and their configurations.

Operational security of the assets using the Service

o

Implement appropriate information security configurations on the assets with regards to the

criticality of the Service. This implementation shall consider the following information security

principles: principle of least privilege, principle of defense in depth, principle of segregation

of duties, principle of traceability for the use of the Service.

o

Review and approve every critical change after an information security risk analysis.

o

Inform the Institut Luxembourgeois de Régulation (hereafter “the Institute”) and its

subcontractor, i.e. the CTIE (hereafter “the Subcontractor”) of such critical change in case it

may impact them.

o

Establish a vulnerability management process.

o

Establish an information security monitoring process.

o

Establish an incident management process and report any information security incident

which concerns the Service and which can endanger the Institute and the Subcontractor.

o

Establish a process of regular review of the calls to the Service in order to detect any abuse.

Sub-contracting

o

Enforce the present information security requirements to any subcontractor involved in the

conception and the operation of the information systems using the Service.

1.2 ACCESS CONTROL

The use of the Service requires strong authentication. The strong authentication means authorized to access

the Service will be described in a separate document, which will be communicated to the notified operators by

the Institute.

Any loss, theft or suspicion of compromise of the strong authentication means shall be notified to the Institute

in order to allow him to block the related accesses.

In the perspective of ensuring the protection of the Luxembourg State’s IT infrastructures, respectively the vital

interests of the State, the Institute or the Subcontractor are authorized to suspend or revoke accesses,either

(i)

upon request of the notified operator,

or at their own discretion

JOURNAL OFFICIEL du Grand-Duché de Luxembourg

MÉMORIAL A - 1105 du 7 décembre 2018

(ii)

in case of suspicion that a notified operator does not respect its obligations or represents a

threat to the security of the Service or to the Subcontractor’s IT infrastructure, or

(iii)

in case of suspicion that the related strong authentication means have been compromised

In the cases (ii) and (iii), the Institute informs the notified operator as soon as possible.

2 SERVICE MANAGEMENT

2.1 SERVICE MANAGER

The notified operators shall appoint a service manager who is responsible for managing the notified operators’

activities related to the Service. The notified operators shall communicate the service manager’s contact data

to the Institute and ensure that this information is at all times up-to-date.

The service managers shall manage and coordinate the processes and ensure compliance with the applicable

regulations. They are the privileged point of contact for the Institute and the Subcontractor, and they shall be

reachable at any time on short notice.

2.2 SERVICE LIFECYCLE

The Service is intended to evolve or to be corrected. Functional or corrective maintenances may happen. The

schedule of these maintenance activities will be communicated in advance to the service managers.

2.3 SUSPENSION OR MODIFICATION OF THE SERVICE

In the event a notified operator does not comply with the current terms and conditions, and to protect the

Subcontractor’s IT infrastructures, either the Institute or the Subcontractor may proceed either (i) with a

suspension, or (ii) with a modification of the Service.

(i)

Suspension

The Institute or the Subcontractor may unilaterally decide to suspend the Service, fully or

partially, in case a notified operator misuses or abuses the Service in a way which could

potentially undermine the Subcontractor’s IT infrastructure.

The Institute or the Subcontractor which activated the suspension measure may maintain this

measure as long as the cause of the suspension remains, or until a satisfactory and

sustainable solution has been identified and implemented by the notified operator.

(ii)

Modification

The Institute or the Subcontractor may proceed with a modification of the Service in case a

notified operator misuses or abuses the Service in a way which could potentially undermine

the Subcontractor’s IT infrastructure.

In both cases, the Institute informs the notified operator as soon as possible.

2.4 INCIDENT MANAGEMENT PROCEDURE

The notified operators commit to establish an incident management procedure, ensuring that incidents are

appropriately managed.

3 LIABILITIES OF USE OF THE SERVICE

The notified operators commit to ensure that their agents, employees, external collaborators, consultants,

providers, and generally all the persons allowed by them to access the Service abide by the terms and

conditions of the current regulation. The use of the Service is performed under the unique responsibility of the

notified operator having provided the access to the Service.

Texte législatif (3 Articles)

Vous souhaitez savoir comment cette disposition s'applique à votre dossier ?