Why card cloning is a real risk
Most RFID access installations still in service rely on credential types that can be copied in seconds with hobbyist hardware:
- 125 kHz proximity cards broadcast a fixed ID with no cryptography at all.
- MIFARE Classic uses the Crypto-1 cipher, publicly broken since 2008; a card's UID and sectors can be dumped and written to a "magic" blank tag.
- Wiegand-26 wiring carries the credential in cleartext from reader to panel, so a clip on the riser cable captures every card that passes.
In each case the system asks the card who are you? and believes the answer. Anti-cloning changes the question to prove it: the card holds a secret key that never leaves the chip, and the reader challenges it with a random number only the real key can answer. Copying the UID, or the entire card memory, does not copy the key. See the DESFire EV3 vs MIFARE Classic deep-dive for the full comparison.
How AXON closes the cloning surface, layer by layer
1. The card must authenticate on every tap
The AXON URX-Secure reader reads the card's real 7-byte UID, selects the AXON ACCESS application (AID F5 10 02) and runs a DESFire AuthenticateAES against that card's own key. Keys are diversified — one root, a READ sub-master per application, an AES-CMAC over the UID to reach the per-card key — so:
- A blank tag carrying a copied UID has the identity but not the key. Authentication fails and, by default, the reader stays dark — no LED, no beep, no frame to the master.
- The reader holds only the READ sub-master. A reader pried off the wall can authenticate AXON cards but cannot format, rewrite or re-key one.
The reader never writes to a card and never reports a grant request on a UID alone; non-AXON cards are ignored unless the master enables UID-only reporting.
2. The reader-to-master link is encrypted and authenticated
In the cabin the reader talks to the AXON CCU-32; at a landing, to the AXON Node — in both cases over RS-485 at 115200 bps, 8N1. Above the CRC16 frame layer runs a secure layer modelled on DESFire itself: a 3-pass mutual authentication yields a per-session key, and every access frame is AES-CTR encrypted, then tagged with an 8-byte CMAC and a per-direction counter. The master re-keys every 5 minutes; a stale counter or bad MAC is dropped, and eight bad frames lock the link for 5 seconds. Recording a grant frame and replaying it does nothing.
3. The floor backbone is encrypted too
At the landings, each Node forwards the authenticated event to the AXON ICM-GE master over Classic CAN at 250 kbit/s. Every Node holds its own AES-128 key derived from a CAN root key and the node ID; traffic is encrypted then MACed with anti-replay counters, and the arbitration ID is bound into the MAC so a frame cannot be replayed to another node. Relay pulses are commanded by the master, never decided locally; no verdict within 800 ms means deny — fail-closed.
4. The decision is local, from a local database
The CCU-32 decides floor permissions from the card table in its own flash; the ICM-GE decides for doors and landings from a 4 MB on-board EEPROM. The cloud only synchronises the database, collects logs and delivers OTA firmware — there is no server in the grant path to spoof, and an internet outage is not an access outage.
Attack versus control
| Attack | Where it fails in AXON |
|---|---|
| Copy UID to a blank tag | AuthenticateAES fails; reader sends nothing |
| Dump a MIFARE Classic card | Classic cards are not AXON credentials; ignored by default |
| Sniff the reader cable | RS-485 frames are AES-CTR encrypted with CMAC |
| Replay a recorded grant frame | Per-direction counter rejects it; 8 bad frames lock the link |
| Inject an "open relay" message on CAN | Per-node key and MAC bound to the arbitration ID |
| Spoof the cloud server | Cloud never makes an access decision |
| Steal a reader for its keys | Reader holds only the READ sub-master; cannot re-key cards |
What we do not claim
AXON does not describe any card as "impossible to clone":
- Today the reader's READ sub-master is stored in software AES; moving it into the on-board ATECC608 secure element is the next firmware step.
- Cryptography does not stop a resident lending a genuine card, tailgating, or cards issued without policy. Card lifecycle — issue, block, expire — lives at the master and has to be used.
- Anti-cloning is a property of the whole chain. A DESFire card on a cleartext Wiegand reader is only as strong as the cable.
Migrating a MIFARE Classic estate
Buildings holding hundreds of Classic cards do not need a hard cutover. The master can set the reader's READ_ALL flag so legacy cards are reported UID-only and marked not authenticated, for logging or a time-boxed transition policy, while DESFire EV3 cards are issued as replacements. Sites that must keep third-party Wiegand readers can bring their D0/D1 lines onto the encrypted RS-485 bus with the AXON AMS converter, shrinking the cleartext path from tens of metres of riser cable to a few centimetres in the back box.
"Akses për kartela të paklonueshme" — what people in Kosovo are asking for
When someone searches for access with cards that cannot be copied, they have usually seen — or suffered — a cloned building card. What they need is a reader that authenticates the card, an encrypted bus behind it, and control over who holds which card. The hardware is the same for a residential tower, an office or a mixed-use site with gates; only the policy at the master changes — per-resident floor masks and central blocking on move-out, per-tenant permission with validity dates, closer log review on public entrances. That is the configuration described here, supplied from local stock in Kosovo. See also Preventing RFID Cloning in Access Systems and the RFID Access Control System overview.
Frequently Asked Questions
Can anti-cloning measures completely eliminate cloning? No system should claim zero risk. AXON reduces it with DESFire EV3 AES-128 mutual authentication, per-card keys, encrypted RS-485 and CAN links, and a master that never grants on a UID alone — and states openly what remains on the roadmap.
What do users mean by "akses për kartela të paklonueshme"? Usually a credential setup that is harder to copy than the Classic or 125 kHz cards common in older buildings, combined with policy control over card issue and revocation.
Is anti-cloning only for high-security sites? No. Residential and commercial buildings gain the most, because that is where cloned cards circulate among former tenants and visitors. The hardware is the same; only the policy differs.