# US 11,115,322 B1 · Stateful network router for managing network appliances > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 11,115,322 B1 - Document ID: US11115322B1 - Status: Granted - Kind: B1 - Application number: 16/366,256 - Filed: 2019-03-27 - Granted: 2021-09-07 - Earliest claimed: 2019-03-27 - Assignees: Amazon Technologies, Inc. - Applicants: Amazon Technologies, Inc. - Inventors: Andrew Bruce Dickinson; Anoop Dawani; Joseph Elmar Magerramov; Nishant Mehta; Lee Spencer Dillard - Web page: https://patentgrep.com/patent/US11115322B1 ## CPC - H04L 43/0876: Network utilisation, e.g. volume of load or congestion level - H04L 41/0816: the condition being an adaptation, e.g. in response to network events - H04L 41/0895: Configuration of virtualised networks or elements, e.g. virtualised network function or OpenFlow elements - H04L 41/0897: by horizontal or vertical scaling of resources, or by migrating entities, e.g. virtual resources or entities - H04L 41/40: using virtualisation of network functions or resources, e.g. SDN or NFV entities - H04L 43/0817: by checking functioning - H04L 43/20: the monitoring system or the monitored elements being virtualised, abstracted or software-defined entities, e.g. SDN or NFV - H04L 45/04: {Interdomain routing, e.g. hierarchical routing} - H04L 45/306: {Route determination based on the nature of the carried application} - H04L 45/38: {Flow based routing} - H04L 45/7453: using hashing - H04L 47/2483: involving identification of individual flows - H04L 47/783: Distributed allocation of resources, e.g. bandwidth brokers - H04L 63/0272: {Virtual private networks} - H04L 43/026: using flow identification - H04L 43/028: by filtering - H04L 43/062: related to network traffic - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract Disclosed are various embodiments of a stateful network router. In one embodiment, a stateful network router intercepts a network data connection between a first host and a second host on a network. The stateful network router routes first data packets from the network data connection sent by the first host to the second host to a target. The stateful network router also routes second data packets from the network data connection sent by the second host to the first host to the target. ## Claims ### Claim 1 A system, comprising: a first virtual private network comprising at least one gateway and at least one machine instance and operated by a first entity using one or more resources provided by a second entity under a utility computing model; a plurality of network appliances on a second network, the plurality of network appliances being operated by the second entity as a service to the first entity under the utility computing model; a stateful network router that routes data from the first virtual private network to and from the plurality of network appliances, wherein inbound traffic flows from the at least one gateway to the at least one machine instance are distributed by the stateful network router among individual network appliances of the plurality of network appliances, and outbound traffic flows from the at least one machine instance to the at least one gateway are distributed by the stateful network router to respective network appliances of the plurality of network appliances that processed the inbound traffic flows corresponding to the outbound traffic flows; and a network appliance scaling service executed in at least one computing device, the network appliance scaling service configured to at least: receive network utilization metrics from the first virtual private network; receive utilization information from the plurality of network appliances; and dynamically scale a quantity of the plurality of network appliances allocated to process the data from the first virtual private network based at least in part on the network utilization metrics and the utilization information. ### Claim 2 (depends on 1) The system of claim 1, wherein upon detecting a failure in a first one of the plurality of network appliances, the stateful network router is configured to redistribute the inbound and outbound traffic flows previously handled by the first one of the plurality of network appliances to one or more others of the plurality of network appliances. ### Claim 3 (depends on 1) The system of claim 1, wherein upon detecting an additional network appliance in the plurality of network appliances, the stateful network router is configured to maintain existing assignments of the inbound and outbound traffic flows within the plurality of network appliances. ### Claim 4 (depends on 1) The system of claim 1, wherein the stateful network router performs flow-based hashing to approximately evenly assign the inbound traffic flows to the individual network appliances. ### Claim 5 (depends on 1) The system of claim 1, wherein the plurality of network appliances are operated within one or more of the at least one machine instance on the second network. ### Claim 6 (depends on 1) The system of claim 1, wherein the stateful network router is configured to perform system health checks on the individual network appliances. ### Claim 7 (depends on 1) The system of claim 1, wherein the plurality of network appliances are configured to perform at least one of: a filtering function, a logging function, an analytical function, or an anti-virus function. ### Claim 8 A method, comprising: receiving, by a stateful network router, a first data packet identifying a first source and a first destination, the first data packet being received from a virtual private network operated by a first entity using one or more resources provided by a second entity under a utility computing model; identifying, by the stateful network router, a particular network appliance from a plurality of network appliances based at least in part on the first data packet, the plurality of network appliances being operated by the second entity as a service to the first entity under the utility computing model; forwarding, by the stateful network router, the first data packet to the particular network appliance for processing without modifying the first source or the first destination; receiving, by the stateful network router, a second data packet identifying a second source and a second destination, the second source being the first destination, and the second destination being the first source; identifying, by the stateful network router, the particular network appliance based at least in part on the second data packet; forwarding, by the stateful network router, the second data packet to the particular network appliance for processing without modifying the second source or the second destination; receiving, by a network appliance scaling service executed in at least one computing device, network utilization metrics from the virtual private network; receiving, by the network appliance scaling service, utilization information from the plurality of network appliances; and dynamically scaling, by the network appliance scaling service, a quantity of the plurality of network appliances allocated to process the data from the virtual private network based at least in part on the network utilization metrics and the utilization information. ### Claim 9 (depends on 8) The method of claim 8, further comprising: receiving, by the stateful network router, the first data packet from the particular network appliance; forwarding, by the stateful network router, the first data packet to the first destination without modifying the first source or the first destination; receiving, by the stateful network router, the second data packet from the particular network appliance; and forwarding, by the stateful network router, the second data packet to the second destination without modifying the second source or the second destination. ### Claim 10 (depends on 8) The method of claim 8, wherein identifying the particular network appliance from the plurality of network appliances based at least in part on the first data packet further comprises applying, by the stateful network router, flow-based hashing on header information of the first data packet to select the particular network appliance. ### Claim 11 (depends on 8) The method of claim 8, further comprising: receiving, by the stateful network router, a third data packet identifying a third source and a third destination; identifying, by the stateful network router, a different network appliance from the plurality of network appliances based at least in part on the third data packet; forwarding, by the stateful network router, the third data packet to the different network appliance for processing without modifying the third source or the third destination; receiving, by the stateful network router, a fourth data packet identifying a fourth source and a fourth destination, the fourth source being the third destination, and the fourth destination being the third source; identifying, by the stateful network router, the different network appliance based at least in part on the fourth data packet; and forwarding, by the stateful network router, the fourth data packet to the different network appliance for processing without modifying the fourth source or the fourth destination. ### Claim 12 (depends on 8) The method of claim 8, wherein forwarding the first data packet to the particular network appliance comprises forwarding the first data packet to the particular network appliance on a second network, receiving the second data packet comprises receiving the second data packet from the virtual private network, and forwarding the second data packet to the particular network appliance further comprises forwarding the second data packet to the particular network appliance on the second network. ### Claim 13 (depends on 8) The method of claim 8, further comprising: determining a level of network traffic processed by the plurality of network appliances and a capacity of the plurality of network appliances; and increasing or decreasing a quantity of the plurality of the network appliances based at least in part on the level of network traffic and the capacity. ### Claim 14 (depends on 8) The method of claim 8, wherein individual ones of the network appliances do not exchange flow state information. ### Claim 15 A system, comprising: at least one computing device configured to at least: intercept a network data connection between a first host and a second host on a virtual private network operated by a first entity using one or more resources provided by a second entity under a utility computing model; route first data packets from the network data connection sent by the first host to the second host to a target network appliance of a plurality of network appliances operated by the second entity as a service to the first entity under the utility computing model; route second data packets from the network data connection sent by the second host to the first host to the target network appliance; receive network utilization metrics from the virtual private network; receive utilization information from the plurality of network appliances; and dynamically scale a quantity of the plurality of network appliances allocated to process the data from the virtual private network based at least in part on the network utilization metrics and the utilization information. ### Claim 16 (depends on 15) The system of claim 15, wherein the at least one computing device is further configured to at least identify the target network appliance from the plurality of network appliances based at least on identifying information for the network data connection. ### Claim 17 (depends on 15) The system of claim 15, wherein the at least one computing device is further configured to at least: forward the first data packets that have been processed by the target network appliance to the second host; and forward the second data packets that have been processed by the target network appliance to the first host. ### Claim 18 (depends on 15) The system of claim 15, wherein the at least one computing device is further configured to at least intercept all data exchanged between all hosts on the virtual private network. ### Claim 19 (depends on 15) The system of claim 15, wherein the target network appliance corresponds to a network appliance machine instance on a second network. ### Claim 20 (depends on 15) The system of claim 15, wherein the at least one computing device is further configured to at least perform flow-based hashing to approximately evenly assign inbound traffic flows to individual ones of the plurality of network appliances.