I’m pleased to announce that a UK patent application for “Dynamic
Access Control for Multiple Digital Resources” filed on 16 August 2026
and now available through the UK intellectual property system.
https://www.search-for-intellectual-property.service.gov.uk/GB2619059.5
The patent application represents an effort to rethink a
surprisingly fundamental part of digital security:
Most digital services rely on authentication.
We enter a password, approve MFA, use a passkey, present a
certificate, or authenticate through another identity mechanism.
“Does the user actually want this resource to be
accessible right now?”
Consider an online banking account that you may access only
a few times per week.
Or an email account that you may not need overnight.
Or a corporate application that employees should access only
during particular periods.
These resources may remain continuously available for login
attempts even when their legitimate users have no intention of accessing them.
The patent explores a different approach.
At the centre of the concept is a Universal Access
Controller capable of participating in the control of access to multiple
digital resources.
Those resources could include:
- corporate
applications;
- email
accounts;
- banking
and financial services;
- SaaS
platforms;
- cloud
services;
- VPN
and remote-access systems;
- APIs;
- websites
and public Internet services; and
- other
digitally accessible resources.
A resource could, for example, be placed into an access-permitted
or access-restricted state.
The architecture behind the idea can be considerably more
sophisticated.
Imagine that an attacker somehow obtains valid credentials.
Under a conventional model:
Valid credentials → Authentication succeeds → Access may
be granted
With an additional access-state control:
Valid credentials → Access state checked → Access
restricted → Access denied
In other words, possession of otherwise valid authentication
credentials does not necessarily mean that the resource should currently be
accessible.
This is intended as an additional security control rather
than a replacement for passwords, MFA, passkeys or existing identity systems.
Another important aspect of the architecture is that
protected application traffic does not necessarily need to pass through the
Universal Access Controller. (Not Zero Trust Network Access).
This creates several possible integration mechanisms,
including APIs, SDKs, identity components, authentication systems, gateways
and machine-to-machine protocols.
More Than Just ON and OFF
Although LOCK and UNLOCK provide an intuitive user
experience, access decisions could potentially become much richer.
For example:
Allow once
Allow for 5 minutes
Allow until logout
Allow only from a trusted device
Require additional authentication
Require user approval
Restrict access
Emergency lock
This could allow users and organisations to express access
policies independently of the individual applications they use.
A business might allow access to certain applications only
during working hours.
A consumer might keep sensitive financial resources
restricted unless they intend to use them.
One View of Access Across Multiple Services
The patent also explores receiving access events from
multiple protected digital resources.
Instead of checking every service individually, a user could
potentially have a unified view showing information such as:
Bank — 3 unsuccessful access attempts
Email — Last login 09:15
Cloud — Active session
Corporate application — Access restricted
Providers could report successful logins, failed attempts,
logout events, sessions and security-related events to the controller.
This creates a common security view across otherwise
independent digital services.
When an Attack on One Resource Protects Another
One of the particularly interesting concepts covered by the
application is cross-resource event-driven access control.
An access event received from one protected digital resource
can cause or contribute to a state transition affecting another protected
digital resource.
Consider this scenario.
An email provider detects repeated suspicious authentication
attempts and reports those events.
The Universal Access Controller evaluates the activity and
determines that the risk is significant.
Emergency Lockdown
The same architecture can support a broader emergency
response.
If a user, administrator, provider or automated security
system determines that an account or device may be under attack, multiple
associated resources could potentially be placed into restricted states.
For an organisation, that might mean temporarily restricting
access to selected corporate systems.
For an individual, it could eventually mean something as
simple as:
Lock my critical digital accounts.
The purpose isn't to replace existing cybersecurity systems.
It is to introduce another security principle:
Being authorised to access something and intending for it
to be accessible are not necessarily the same thing.
From Corporate Applications to the Public Internet
The original thinking behind this work started with my own
startups (corporate) applications and as part of ALightVPN (VPN but there are
more plans) and a plan to minimize 90% of cyber crime.
The same principle can potentially apply to ordinary
consumers and the services they use every day.
Email.
Banking.
Cloud accounts.
SaaS.
Remote access.
Public websites.
And future digital services that have not yet been created.
That led to the broader concept reflected in the patent
title:
“Dynamic Access Control for Multiple Digital Resources”
The UK patent application was filed on 16 August 2026.
Filing a patent application is, of course, the beginning of
the patent examination process rather than the grant of a patent. The claims
will ultimately need to withstand the relevant novelty, inventive-step and
other patentability requirements.
But filing the application establishes an important
milestone for this work.
The broader goal is straightforward:
Give people and organisations more direct control over digital
resources can be accessed—and create a common security control plane capable of
extending that protection across multiple independent services.
Follow on social media to stay updated on the latest developments:
ALight Technologies USA Inc | Facebook
https://www.facebook.com/ALightTechnologyAndServicesLimited
https://www.linkedin.com/company/alight-technologies-usa-inc/
https://www.linkedin.com/company/alight-technology-and-services-limited/
https://twitter.com/ALightTech
https://www.youtube.com/@alighttechnologyandservicesltd
https://blog.alightservices.com/
https://medium.com/@ALlightTechnologyAndServices
-
Best regards,
I don’t have any fake aliases, nor any virtual aliases like some of the the psycho spy R&AW traitors of India. NOT associated with the “ass”, “es”, “eka”, “ok”, “okay”, “is”, erra / yerra karan, kamalakar, diwakar, kareem, karan, erra / yerra sowmya, erra / yerra, zinnabathuni, bojja srinivas (was a friend and batchmate 1998 – 2002, not anymore – if he joined Mafia), mukesh golla (was a friend and classmate 1998 – 2002, if he joined Mafia), erra, erra, thota veera, uttam’s, bandhavi’s, bhattaru’s, thota’s, bojja’s, bhattaru’s or Arumilli srinivas or Arumilli uttam(may be they are part of a different Arumilli family – not my Arumilli family).
