Patent Filed: How We Control Access to Our Digital Resources

 

I’m pleased to announce that a UK patent application for “Dynamic Access Control for Multiple Digital Resources” filed on 16 August 2026 and now available through the UK intellectual property system.

 

https://www.search-for-intellectual-property.service.gov.uk/GB2619059.5

  I thank Microsoft for Startup Founders, Corporate Vision Magazine, Government of U.K, Perplexity, NASSCOM 10000, my parents, my elder sister.

 

The patent application represents an effort to rethink a surprisingly fundamental part of digital security:

Most digital services rely on authentication.

We enter a password, approve MFA, use a passkey, present a certificate, or authenticate through another identity mechanism.

“Does the user actually want this resource to be accessible right now?”

Consider an online banking account that you may access only a few times per week.

Or an email account that you may not need overnight.

Or a corporate application that employees should access only during particular periods.

These resources may remain continuously available for login attempts even when their legitimate users have no intention of accessing them.

The patent explores a different approach.

At the centre of the concept is a Universal Access Controller capable of participating in the control of access to multiple digital resources.

Those resources could include:

• corporate applications;
• email accounts;
• banking and financial services;
• SaaS platforms;
• cloud services;
• VPN and remote-access systems;
• APIs;
• websites and public Internet services; and
• other digitally accessible resources.

A resource could, for example, be placed into an access-permitted or access-restricted state.

The architecture behind the idea can be considerably more sophisticated.

Imagine that an attacker somehow obtains valid credentials.

Under a conventional model:

Valid credentials → Authentication succeeds → Access may be granted

With an additional access-state control:

Valid credentials → Access state checked → Access restricted → Access denied

In other words, possession of otherwise valid authentication credentials does not necessarily mean that the resource should currently be accessible.

This is intended as an additional security control rather than a replacement for passwords, MFA, passkeys or existing identity systems.

Another important aspect of the architecture is that protected application traffic does not necessarily need to pass through the Universal Access Controller. (Not Zero Trust Network Access).

This creates several possible integration mechanisms, including APIs, SDKs, identity components, authentication systems, gateways and machine-to-machine protocols.

More Than Just ON and OFF

Although LOCK and UNLOCK provide an intuitive user experience, access decisions could potentially become much richer.

For example:

Allow once

Allow for 5 minutes

Allow until logout

Allow only from a trusted device

Require additional authentication

Require user approval

Restrict access

Emergency lock

This could allow users and organisations to express access policies independently of the individual applications they use.

A business might allow access to certain applications only during working hours.

A consumer might keep sensitive financial resources restricted unless they intend to use them.

One View of Access Across Multiple Services

The patent also explores receiving access events from multiple protected digital resources.

Instead of checking every service individually, a user could potentially have a unified view showing information such as:

Bank — 3 unsuccessful access attempts

Email — Last login 09:15

Cloud — Active session

Corporate application — Access restricted

Providers could report successful logins, failed attempts, logout events, sessions and security-related events to the controller.

This creates a common security view across otherwise independent digital services.

When an Attack on One Resource Protects Another

One of the particularly interesting concepts covered by the application is cross-resource event-driven access control.

An access event received from one protected digital resource can cause or contribute to a state transition affecting another protected digital resource.

Consider this scenario.

An email provider detects repeated suspicious authentication attempts and reports those events.

The Universal Access Controller evaluates the activity and determines that the risk is significant.

Emergency Lockdown

The same architecture can support a broader emergency response.

If a user, administrator, provider or automated security system determines that an account or device may be under attack, multiple associated resources could potentially be placed into restricted states.

For an organisation, that might mean temporarily restricting access to selected corporate systems.

For an individual, it could eventually mean something as simple as:

Lock my critical digital accounts.

The purpose isn't to replace existing cybersecurity systems.

It is to introduce another security principle:

Being authorised to access something and intending for it to be accessible are not necessarily the same thing.

From Corporate Applications to the Public Internet

The original thinking behind this work started with my own startups (corporate) applications and as part of ALightVPN (VPN but there are more plans) and a plan to minimize 90% of cyber crime.

The same principle can potentially apply to ordinary consumers and the services they use every day.

Email.

Banking.

Cloud accounts.

SaaS.

Remote access.

Public websites.

And future digital services that have not yet been created.

That led to the broader concept reflected in the patent title:

“Dynamic Access Control for Multiple Digital Resources”

The UK patent application was filed on 16 August 2026.

Filing a patent application is, of course, the beginning of the patent examination process rather than the grant of a patent. The claims will ultimately need to withstand the relevant novelty, inventive-step and other patentability requirements.

But filing the application establishes an important milestone for this work.

The broader goal is straightforward:

Give people and organisations more direct control over digital resources can be accessed—and create a common security control plane capable of extending that protection across multiple independent services.

 

Follow on social media to stay updated on the latest developments:

ALight Technologies USA Inc | Facebook

https://www.facebook.com/ALightTechnologyAndServicesLimited

Web Veta | Facebook

WebVeta Saas | LinkedIn

https://www.linkedin.com/company/alight-technologies-usa-inc/

https://www.linkedin.com/company/alight-technology-and-services-limited/

https://twitter.com/ALightTech

https://www.youtube.com/@alighttechnologyandservicesltd

https://blog.alightservices.com/

https://medium.com/@ALlightTechnologyAndServices

-

Best regards,

Mr. Kanti Arumilli 

I don’t have any fake aliases, nor any virtual aliases like some of the the psycho spy R&AW traitors of India. NOT associated with the “ass”, “es”, “eka”, “ok”, “okay”, “is”, erra / yerra karan, kamalakar, diwakar, kareem, karan, erra / yerra sowmya, erra / yerra, zinnabathuni, bojja srinivas (was a friend and batchmate 1998 – 2002, not anymore – if he joined Mafia), mukesh golla (was a friend and classmate 1998 – 2002, if he joined Mafia), erra, erra, thota veera, uttam’s, bandhavi’s, bhattaru’s, thota’s, bojja’s, bhattaru’s or Arumilli srinivas or Arumilli uttam(may be they are part of a different Arumilli family – not my Arumilli family).