What an RFID access control system is
An RFID access control system replaces keys and shared codes with a contactless credential — a card or fob — that a reader identifies at 13.56 MHz. Behind the reader, a controller checks the credential against a permission table and, if allowed, closes a relay contact: a door strike, a maglock, a barrier motor, or one floor button in an elevator cabin. Every decision is logged, so the building manager can see who entered where and when.
What makes an installation secure and manageable is where the decision is taken, how the credential is verified, and how the wires between reader, controller and relay are protected.
The four parts of the system
| Part | What it does | AXON product |
|---|---|---|
| Credential | Proves who is tapping | MIFARE DESFire EV3 card or fob (AES-128) |
| Reader | Authenticates the card, reports the UID | AXON URX-Secure on RS-485 |
| Master | Holds the permission table, decides, logs | AXON CCU-32 in the cabin; AXON ICM-GE for landings, doors and gates |
| Output | Executes the verdict | CCU-32 floor relays, AXON Node relays, AXON RBN-2 / SC-E relay nodes |
Policy lives in one place: when a tenant leaves or a contractor's validity date passes, the change is made once at the master and every reader and relay follows.
How AXON lays out a building
AXON runs a building as two subsystems that share the same reader, card platform and wire protocol.
Subsystem A — the elevator cabin. A URX-Secure reader inside the cabin talks encrypted RS-485 (115200 bps, half-duplex) to the CCU-32 cabin master. The CCU-32 checks the card against its local permissions and pulses one relay per allowed floor for 3 seconds, so the passenger can press only the buttons that card is entitled to. The elevator's own call-button wiring is untouched.
Subsystem B — everything outside the cabin. Each landing, entrance, door, garage or ramp gets an AXON Node with a reader beside it. The reader speaks RS-485 to the Node; the Node forwards the event over an encrypted CAN backbone (Classic CAN 2.0B, 250 kbit/s) to the ICM-GE master. The master looks the card up in its on-board database — blocked flag, per-node and per-relay permission mask, validity dates — and answers with a verdict, relay mask and pulse length. The Node pulses its relays only on a verified grant; no answer within 800 ms means deny.
| Link | Physical layer | Protection |
|---|---|---|
| Reader ↔ CCU-32 or Node | RS-485, 115200 8N1 | 3-pass mutual auth, AES-CTR + 8-byte CMAC, per-direction counters |
| Node ↔ ICM-GE | CAN 250 kbit/s, up to 120 access points per port, 2 ports | Per-node AES-128 key, encrypt-then-MAC, hardware acceptance filters |
| Relay nodes (RBN-2, SC-E) | AXON RS-485 bus | Addressed commands from the master |
| Master ↔ cloud | Ethernet uplink (LTE modem fitted, in development) | MQTT over TLS — sync and logs only |
Why the riser uses CAN while the cabin and readers use RS-485 is covered in RS-485 vs CAN vs Ethernet for access control.
Use cases: doors, entrances, garages, ramps, floors
The Node's DIP switches carry a device-type field with exactly four values — floor, door, garage, ramp — the access points a residential or mixed-use building actually has:
- Entrance and internal doors. Reader and Node at the door; the Node's relay drives the strike or maglock. An RBN-2 can add a corridor light or alarm output next to the load.
- Garage. The same Node with device type garage; the relay pulses the gate or barrier controller. An IP65 reader variant covers the outdoor position.
- Vehicle ramp. A ramp reader for authorised vehicles, often a legacy Wiegand reader kept through an AXON AMS converter behind the Node.
- Elevator floors. The CCU-32 in the cabin enables the resident's home floor plus shared floors such as garage and roof; a landing Node with a call relay handles the hall side.
All of these arrive at one master, so a resident's card carries one policy — home floor, garage, main entrance — and every event is logged with a reason code: unknown card, blocked, no floor permission, expired. Topology examples: access control for multi-entrance buildings.
Why the credential matters: DESFire EV3
Older RFID systems trusted the card's serial number (UID). A UID can be read by anyone and written onto a blank tag, which is why cloned fobs are common. AXON's reader never grants on a UID alone: it selects the AXON application on a MIFARE DESFire EV3 card, derives that card's key from its UID with AES-CMAC and runs a DESFire AuthenticateAES. A copied UID or a MIFARE Classic clone fails the exchange and, by default, produces no LED, no beep and no frame on the bus.
The reader holds only a READ sub-master key, so a stolen reader cannot format or re-key cards, and the UID is encrypted on the RS-485 and CAN links, so a passive tap on the riser cannot track residents floor by floor. Details in Anti-cloning RFID and DESFire EV3 vs MIFARE Classic.
Central management, local decisions
Centralised monitoring and offline operation are not opposites here. The master keeps the full card database and a local event log on the board; the Ethernet or LTE uplink pushes log batches up and pulls database updates, remote relay commands and OTA firmware down when it is available. If the building's internet drops, nothing changes at the door or in the cabin: the same card is authenticated, the same local table is consulted, and the event waits in the log until the link returns.
Retrofit without replacing every reader
Many buildings have working Wiegand readers on a failing panel. Instead of re-cabling every door, an AXON AMS (W2R-N) sits in the reader's back box, takes D0/D1 and republishes the credential as an addressed message on the AXON RS-485 bus. The cleartext Wiegand run shrinks to a few centimetres, and DESFire EV3 readers can be phased in door by door.
Planning checklist
- Count access points by type — floors, doors, garages, ramps — to size the Node count and decide whether to split a tall riser across the ICM-GE's two CAN ports.
- Decide which elevators need a CCU-32 in the cabin (32 relays; 48 / 64 to order).
- Terminate RS-485 and CAN segments with 120 Ω at both physical ends; daisy-chain, no star wiring.
- Plan the credential rollout: DESFire EV3 for new cards, AMS converters where legacy readers must stay.
Frequently asked questions
Can RFID access be used for both doors and elevators? Yes. The cabin runs on the CCU-32; doors, entrances, garages and landings run on the ICM-GE with Nodes. Both use the same URX-Secure reader, DESFire EV3 card and encrypted RS-485 protocol, so one credential carries a unified policy for the whole building.
Is centralised monitoring available? Yes. Every grant and deny is written to the master's local log with a reason code and synchronised to the AXON cloud over MQTT/TLS when the uplink is available. Database updates, remote relay commands and OTA firmware travel the same way; the access decision itself is always local.
What happens if the internet is down? Nothing changes at the door or in the cabin. The master decides from its last synchronised database and queues events; a Node fails closed if the master is silent, and the reader shows a deny if no verdict arrives within one second.
Can this be deployed for Kosovo projects? Yes. AXON boards are designed and built in Kosovo, supplied from local stock, and sized for local integrators and elevator companies. See Access Control Kosovo.
Related pages: How elevator access control works · Smart building access control · Technical documentation