# US 12,771,690 B2 · Method and system for enabling multi-factor authentication for incompatible third-party radius clients using a proxy server

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 12,771,690 B2
- Document ID: US12771690B2
- Status: Granted
- Kind: B2
- Application number: 18/627,714
- Filed: 2024-04-05
- Published: 2025-10-09
- Granted: 2026-10-20
- Earliest claimed: 2024-04-05
- Assignees: Saudi Arabian Oil Company
- Applicants: Saudi Arabian Oil Company
- Inventors: Hafed A. Al Ghamdi; Faisal A. Julaidan; Maryah A. Alghamdi
- Web page: https://patentgrep.com/patent/US12771690B2

## CPC

- H04L 63/0884: {by delegation of authentication, e.g. a proxy authenticates an entity to be authenticated on behalf of this entity vis-à-vis an authentication entity}
- H04L 63/0435: {wherein the sending and receiving network entities apply symmetric encryption, i.e. same key used for encryption and decryption (cryptographic mechanisms or cryptographic arrangements for symmetric key encryption H04L9/06)}
- H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)}
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)

## Abstract

A computer-implemented method for enabling multi-factor authentication for incompatible third-party Remote Authentication Dial-In User Service (“RADIUS”) clients includes a proxy server. The proxy server receives an authentication request from a particular RADIUS client. The proxy server then validates the request for compatibility with a RADIUS server and determines whether the request must be modified. Then, the proxy server forwards the validated and modified authentication request to the RADIUS server which triggers a response from the RADIUS server. Subsequently, the RADIUS server response is translated into a compatible format for the particular, third-party RADIUS client and is then forwarded from the RADIUS server back to that particular, third-party RADIUS client. Also disclosed is a system for enabling multi-factor authentication for incompatible third-party RADIUS clients using a proxy server.

## Claims

### Claim 1

A computer-implemented method for enabling multi-factor authentication for incompatible third-party Remote Authentication Dial-In User Service (“RADIUS”) clients using a proxy server, wherein the incompatible third-party RADIUS clients utilize authentication protocol versions or attribute formats that are natively incompatible with an expected format of the RADIUS server, the method comprising the following steps performed by a processor within the proxy server:
receiving, at the proxy server, an authentication request from a particular, third-party RADIUS client;
validating, at the proxy server, the received authentication request for compatibility with the RADIUS server prior to authentication, comprising comparing the received authentication request against one or more predetermined compatible authentication request formats to identify missing or superfluous attributes;
determining, at the proxy server, whether modification of the request is required prior to authentication;
modifying, at the proxy server, the received authentication request from the third-party RADIUS clients prior to authentication, if during the determining step it was determined that modification of the request is required, wherein the modifying comprises at least one of adding one or more missing attributes required by the RADIUS server or removing one or more superfluous attributes not required by the RADIUS server to ensure each of the received authentication request's validity and format compatibility with the RADIUS server for authentication and authorization;
forwarding, by the proxy server, the validated and modified authentication request to the RADIUS server;
receiving, at the proxy server, a response from the RADIUS server;
translating, at the proxy server, the response from the RADIUS server into a compatible format for the particular, third-party RADIUS client; and
forwarding, by the proxy server, the response from the RADIUS server to the particular, third-party RADIUS client.

### Claim 2 (depends on 1)

The method of claim 1, wherein validating the authentication request comprises identifying missing attributes required by the RADIUS server.

### Claim 3 (depends on 1)

The method of claim 1, wherein determining whether to modify the request comprises performing a comparison of predetermined compatible authentication request formats with the received authentication request.

### Claim 4 (depends on 1)

The method of claim 1, wherein modifying the authentication request includes adding required attributes to the request which were absent in the initial request received from the particular, third-party RADIUS client.

### Claim 5 (depends on 1)

The method of claim 1, wherein the proxy server is configured to compare the request with a predetermined compatible request captured by a simulation tool.

### Claim 6 (depends on 1)

The method of claim 1, wherein the step of receiving a response from the RADIUS server further includes determining, by the proxy server, whether a user is granted or denied access based on the response.

### Claim 7 (depends on 1)

The method of claim 1, wherein the step of translating the RADIUS server response includes converting the RADIUS server's response attributes into a format compatible with the particular, third-party RADIUS client.

### Claim 8 (depends on 1)

The method of claim 1, wherein the proxy server communicates with the RADIUS server using an encrypted communication channel employing a shared secret.

### Claim 9 (depends on 1)

The method of claim 1, wherein translating the response includes applying prescribed logic by code executing in the processor to reflect specific criteria defined by the particular, third-party RADIUS client.

### Claim 10

A system for enabling multi-factor authentication for incompatible third-party Remote Authentication Dial-In User Service (“RADIUS”) clients, wherein the incompatible third-party RADIUS clients utilize authentication protocol versions or attribute formats that are natively incompatible with an expected format of a RADIUS server, the system comprising:
a proxy server; and
a hardware processor, housed within and communicatively connected within the proxy server;
wherein the processor executes code that configures the proxy server to:
act as an intermediary between incompatible third-party RADIUS clients and a RADIUS server;
validate and modify authentication requests received from third-party RADIUS clients prior to authentication, comprising comparing each received authentication request against one or more predetermined compatible authentication request formats to identify missing or superfluous attributes, and adding one or more missing attributes required by the RADIUS server or removing one or more superfluous attributes not required by the RADIUS server to ensure each of the received authentication request's validity and format compatibility with the RADIUS server for authentication and authorization;
translate and forward modified authentication requests to the RADIUS server;
receive responses from the RADIUS server; and
translate the responses into a format compatible with any given third-party RADIUS client among the third-party RADIUS clients.

### Claim 11 (depends on 10)

The system of claim 10, wherein the proxy server is further configured by code executing in the processor in order to validate authentication requests by identifying missing or unnecessary attributes.

### Claim 12 (depends on 11)

The system of claim 11, wherein the proxy server is further configured to specify required and superfluous attributes in relation to the RADIUS server's requirements.

### Claim 13 (depends on 10)

The system of claim 10, wherein the proxy server is further configured to accept a shared secret for establishing secure communication with both a particular third-party RADIUS client among the third-party RADIUS clients and the RADIUS server.

### Claim 14 (depends on 10)

The system of claim 10, wherein the proxy server is further configured such that translating RADIUS server responses comprises the application of prescribed logic to accommodate the specific needs of respective, different third-party RADIUS clients.

### Claim 15 (depends on 10)

The system of claim 10, wherein the proxy server further comprises a FreeRADIUS server installed on a computing platform in communication with the RADIUS server and configured to implement modifications to the authentication requests.

### Claim 16 (depends on 10)

The system of claim 10, wherein the system is further configured to identify and discard attributes from the authentication request that otherwise cause the RADIUS server to reject the request.

### Claim 17 (depends on 1)

The method of claim 1, wherein the proxy server maintains a mapping of client-specific translation rules for each of the incompatible third-party RADIUS clients, and wherein the modifying is performed in accordance with the client-specific translation rules corresponding to the particular, third-party RADIUS client.

### Claim 18 (depends on 10)

The system of claim 10, wherein the proxy server maintains a mapping of client-specific translation rules for each of the incompatible third-party RADIUS clients, and wherein the code further configures the proxy server to modify authentication requests in accordance with the client-specific translation rules corresponding to a given third-party RADIUS client among the third-party RADIUS clients.