# US 11,310,146 B1 · System and method for optimal multiserver VPN routing > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 11,310,146 B1 - Document ID: US11310146B1 - Status: Granted - Kind: B1 - Application number: 17/214,852 - Filed: 2021-03-27 - Granted: 2022-04-19 - Earliest claimed: 2021-03-27 - Assignees: Netflow, UAB - Applicants: Netflow, UAB - Inventors: Karolis Kaciulis; Donatas Budvytis - Web page: https://patentgrep.com/patent/US11310146B1 ## CPC - H04L 45/34: {Source routing} - H04L 45/02: Topology update or discovery - H04L 63/0272: {Virtual private networks} - H04L 63/0428: {wherein the data content is protected, e.g. by encrypting or encapsulating the payload} - H04L 45/033: by updating distance vector protocols - H04L 63/08: {for authentication of entities (cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32)} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract A method and system for a VPN setup in which one of the peers' outgoing traffic is dynamically rerouted to exit VPN servers based on infrastructure or user requirements without losing the initial connection state or leaking unencrypted network traffic is described. One exemplary embodiment describes a method for a client to change their routing to multiple server locations. Another exemplary embodiment describes a method for the entry VPN servers to reroute traffic based on strategic traffic analysis. ## Claims ### Claim 1 A method for routing a VPN connection, the method comprising: establishing, between an entry VPN server and a user device, a single VPN connection; receiving, at the entry VPN server from the user device, a first traffic; forwarding, from the entry VPN server, the first traffic through a first exit VPN server; aggregating, at the entry VPN server, data activity packets from the first traffic into a traffic information; matching, at the entry VPN server, the traffic information with a configuration strategy to route the first traffic from the user device through a second exit VPN server, different from the first exit VPN server; assigning, at the entry VPN server, the configuration strategy to the user device to route traffic through the second exit VPN server; receiving, at the entry VPN server from the user device, a second traffic originating from the user device after the first traffic has originated from the user device; and forwarding, at the entry VPN server, the second traffic through the second exit VPN server, wherein a single VPN connection is maintained between the user device and the entry VPN server to service the first traffic and the second traffic. ### Claim 2 (depends on 1) The method of claim 1, wherein the first traffic is directed to a first target, and the second traffic is directed to the first target or to a second target, different from the first target. ### Claim 3 (depends on 1) The method of claim 1, wherein the first and the second traffic consists of TCP or UDP datagrams. ### Claim 4 (depends on 1) The method of claim 1, wherein the configuration strategies are generated based on at least one of the following: used protocols, target IP addresses, or target ports. ### Claim 5 (depends on 2) The method of claim 2, further comprising: receiving, at the entry VPN server, an instruction from the user device to route the first traffic or the second traffic or both, through a third exit VPN server, different from the first exit VPN server and the second exit VPN server; receiving, at the entry VPN server from the user device, a third traffic to the first target or to the second target; and forwarding, at the entry VPN server, the third traffic through the third exit VPN server, different from the first exit VPN server. ### Claim 6 (depends on 5) The method of claim 5, wherein the instructions include a reference to a geographic location of the third exit VPN server. ### Claim 7 (depends on 5) The method of claim 5, wherein the third traffic consists of TCP or UDP datagrams. ### Claim 8 (depends on 1) The method of claim 1, wherein the entry VPN server receives updated configuration strategies from a centralized data channel for a service provider infrastructure. ### Claim 9 (depends on 1) The method of claim 1, wherein the data transfer between the entry VPN server and the first exit VPN server or the second exit VPN server is conducted over an encrypted connection. ### Claim 10 (depends on 1) The method of claim 1, wherein the second traffic is associated with a different domain than a domain of the first traffic. ### Claim 11 (depends on 1) The method of claim 1, wherein the data activity packets of the first traffic or the second traffic are aggregated while the first traffic and the second traffic are routed. ### Claim 12 A computing apparatus for routing a VPN connection, the apparatus comprising: at least one processor; and a memory coupled to the at least one processor, the memory storing computer-executable instructions that, when executed by the at least one processor, operate the apparatus to perform a method comprising: establishing, between an entry VPN server and a user device, a single VPN connection; receiving, at the entry VPN server from the user device, a first traffic; forwarding, from the entry VPN server, the first traffic through a first exit VPN server; aggregating, at the entry VPN server, data activity packets from the first traffic into a traffic information; matching, at the entry VPN server, the traffic information with a configuration strategy to route the first traffic from the user device through a second exit VPN server, different from the first exit VPN server; assigning, at the entry VPN server, the configuration strategy to the user device to route traffic through the second exit VPN server; receiving, at the entry VPN server from the user device, a second traffic originating from the user device after the first traffic has originated from the user device; forwarding, at the entry VPN server, the second traffic through the second exit VPN server, wherein a single VPN connection is maintained between the user device and the entry VPN server to service the first traffic and the second traffic. ### Claim 13 (depends on 12) The apparatus of claim 12, wherein the first traffic is directed to a first target, and the second traffic is directed to the first target or to a second target, different from the first target. ### Claim 14 (depends on 13) The apparatus of claim 13, wherein the instructions further configure the apparatus to: receiving, at the entry VPN server, an instruction from the user device to route the first traffic or the second traffic or both, through a third exit VPN server, different from the first exit VPN server and the second exit VPN server; receiving, at the entry VPN server from the user device, a third traffic to the first target or to the second target; forwarding, at the entry VPN server, the third traffic through the third exit VPN server, different from the first exit VPN server. ### Claim 15 (depends on 12) The apparatus of claim 12, wherein the data activity packets of the first traffic or the second traffic are aggregated while the first traffic and the second traffic are routed. ### Claim 16 A non-transitory computer-readable medium comprising stored computer-executable instructions, the computer-executable instructions configured to implement a method for routing a VPN connection comprising: establishing, between an entry VPN server and a user device, a single VPN connection; receiving, at the entry VPN server from the user device, a first traffic; forwarding, from the entry VPN server, the first traffic through a first exit VPN server; aggregating, at the entry VPN server, data activity packets from the first traffic into a traffic information; matching, at the entry VPN server, the traffic information with a configuration strategy to route the first traffic from the user device through a second exit VPN server, different from the first exit VPN server; assigning, at the entry VPN server, the configuration strategy to the user device to route traffic through the second exit VPN server; receiving, at the entry VPN server from the user device, a second traffic originating from the user device after the first traffic has originated from the user device; forwarding, at the entry VPN server, the second traffic through the second exit VPN server, wherein a single VPN connection is maintained between the user device and the entry VPN server to service the first traffic and the second traffic. ### Claim 17 (depends on 16) The computer-readable medium of claim 16, wherein the first traffic is directed to a first target, and the second traffic is directed to the first target or to a second target, different from the first target. ### Claim 18 (depends on 17) The computer-readable medium of claim 17, wherein the instructions further configure the computer to: receiving, at the entry VPN server, an instruction from the user device to route the first traffic or the second traffic or both, through a third exit VPN server, different from the first exit VPN server and the second exit VPN server; receiving, at the entry VPN server from the user device, a third traffic to the first target or to the second target; forwarding, at the entry VPN server, the third traffic through the third exit VPN server, different from the first exit VPN server. ### Claim 19 (depends on 16) The computer-readable medium of claim 16, wherein the data activity packets of the first traffic or the second traffic are aggregated while the first traffic and the second traffic are routed.