Why elevator access control matters
Modern buildings need controlled access not only at the entrance but inside the elevator cabin. Once past the lobby, an unrestricted elevator takes anyone to any floor — a tenant's office, a hotel's staff level, a hospital ward, a private roof terrace. Floor-level access control closes that gap: each credential is linked to a set of floors, and the elevator only accepts calls to those floors. It matters most in residential towers, multi-tenant offices, hotels and hospitals where different groups share one cabin but not the same destinations.
How an AXON elevator access system works
A single card tap runs end to end like this:
- Card tap at the reader. The AXON URX-Secure reader reads the card's UID and runs a DESFire
AuthenticateAESagainst the AXON application on the card. A card that cannot answer the challenge produces no event at all. - Encrypted event to the cabin master. The reader sends a
CARD_EVENTframe to the CCU-32 over RS-485. The frame is AES-CTR encrypted, CMAC-tagged and counter-protected, so a replayed or forged frame is dropped before it is parsed. - Local decision. The CCU-32 looks the card up in its on-board permission table and answers within the reader's 1-second window. The reader shows green on a grant, red on a deny.
- Floor relays pulse. For each floor the card is entitled to, the matching relay closes for 3 seconds. The passenger presses that button on the elevator's original panel; other buttons stay disabled.
- Event logged and synced. The event is queued locally and published over MQTT/TLS to the AXON cloud when Ethernet or the cellular fallback is available.
The elevator's own call-button wiring is not redesigned. The CCU-32 simply enables or leaves disabled the buttons a card may use — which is why it works with any elevator brand.
Components of an elevator access control system
| Component | AXON module | Role |
|---|---|---|
| Cabin controller | AXON CCU-32 | Holds floor permissions, drives 32 relays per unit (units chain — no floor cap), decides offline |
| Cabin / landing reader | AXON URX-Secure | DESFire EV3 authentication, encrypted RS-485 link to the master |
| Floor node | AXON Node | Per-landing RS-485 to CAN bridge with two relays for door release and call signal |
| External master | AXON ICM-GE | Master for landings, entrances and doors; card database on board, two CAN buses |
| Wiegand converter | AXON AMS | Brings an existing Wiegand 26/34 reader onto the AXON RS-485 bus |
| Push-button bridge | AXON PBC-Bridge | Retrofit converter for legacy call-button wiring (in development) |
| Elevator master | AXON ELM-GE | Direct destination calls to the elevator controller instead of relays (in development) |
Communication runs on three layers: AES-128 encrypted RS-485 between readers and their master, a 250 kbit/s CAN backbone between floor nodes and the ICM-GE, and an Ethernet-first uplink with cellular fallback for database sync, logs and firmware. See RS-485 vs CAN vs Ethernet for why each bus sits where it does.
Cabin and landings: two subsystems, one card
An elevator access project usually has two halves, and AXON separates them deliberately.
- Subsystem A — inside the cabin. The CCU-32 is the master. It polls the in-cabin reader over RS-485 and controls the floor buttons through its relays. Supply is 12–24 V DC, consumption 3–6 W, reader cable under 30 metres.
- Subsystem B — landings, entrances, doors and gates. The ICM-GE is the master, one per building. Each landing has an AXON Node next to its reader; the node forwards the card event over CAN and pulses its two relays only when the master says so. If no verdict arrives within 800 ms the tap expires as a deny. Up to 120 access points fit on each of the master's two CAN ports — 240 per master — and masters combine for larger sites.
The same URX-Secure reader, with the same firmware, serves both positions; only its bus address differs. One card carries a resident from the street door to the landing to their home floor with one permission record.
Secure RFID and anti-cloning
The usual weakness of elevator access systems is the credential itself. Wiegand-26 and MIFARE Classic cards report a UID in cleartext, and a UID can be copied onto a blank tag with a hobbyist cloner in seconds.
AXON's answer is MIFARE DESFire EV3 with mutual authentication. Each card carries a per-card key derived from its UID with AES-CMAC; the reader challenges the card, and only a card holding the correct key answers. A clone has the UID but not the key, so authentication fails and the reader stays dark — no LED, no beep, no frame to the master. The bus is protected too: the UID never crosses RS-485 or CAN in the clear, so a passive tap on the wiring cannot track residents floor by floor. Read more in Anti-Cloning RFID and the URX-Secure technical guide.
For retrofits that must keep third-party Wiegand readers, the CCU-32 accepts a Wiegand-26 reader on its D0/D1 inputs and the AXON AMS converts Wiegand 26/34 onto the RS-485 bus — with the credential in cleartext until the reader is upgraded.
Retrofitting an existing elevator
Most projects in the region are retrofits of elevators already in service. The relay-per-button approach leaves the elevator's control wiring and certification untouched, and where no network cable reaches the cabin the CCU-32's cellular uplink handles database sync and log upload — fit an external antenna, since the steel cabin attenuates signal. Firmware arrives over the same uplink into a two-slot OTA layout that is verified before it is applied.
Elevator access in Kosovo
In Kosovo, building managers and elevator companies commonly search for "akses per ashensor", "akses per lifta" or "akses per kabine te ashensorit". AXON supplies these installations from local stock — the CCU-32 for the cabin, URX-Secure readers, Nodes and the ICM-GE for the rest of the building — sized to the floor count and cabin count of the project.
For the local market this also connects to related needs — akses ne Kosove, akses per objekt, akses per dyer and akses per garazh — where floor control and entrance control should run on one credential and one management platform rather than separate systems per door.
Request a quote
Tell us the number of floors and cabins, whether a network cable reaches the cabin, and whether landings, entrances or garages are included. Contact AXON for a project assessment, or read How Elevator Access Control Works for the full technical walkthrough.
Frequently asked questions
Can elevator access be restricted per floor? Yes. Each credential carries a floor mask, and the CCU-32 pulses only the relays for the floors that card is entitled to. Permissions are configured per user and pushed to the cabin master on the next sync.
Does the elevator keep working if the internet is down? Yes. The decision is made on the CCU-32 from its local permission table; the server only synchronises the card database, collects logs and delivers firmware. Events are queued locally and published when the link returns.
Can the system reduce card cloning risks? Yes. DESFire EV3 mutual authentication with per-card AES-128 keys means a copied UID cannot pass the reader's challenge, and the RS-485 and CAN links are encrypted so the UID is never exposed on the wiring.
Is this suitable for residential buildings? Yes. Residential towers are the most common installation: each resident's card enables their home floor plus shared floors such as garage or roof, and the same card opens the building entrance through the landing subsystem.
Do I need to rewire the elevator's call buttons? No. The CCU-32 enables or disables the existing buttons through one relay per floor. The elevator controller and its certification are left as they are.