# US 11,444,808 B1 · Scaling network address translation (NAT) and firewall functionality to support public cloud networks > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 11,444,808 B1 - Document ID: US11444808B1 - Status: Granted - Kind: B1 - Application number: 17/087,553 - Filed: 2020-11-02 - Granted: 2022-09-13 - Earliest claimed: 2015-09-29 - Assignees: Aviatrix Systems, Inc. - Applicants: Aviatrix Systems, Inc. - Inventors: Xiaobo Sherry Wei - Web page: https://patentgrep.com/patent/US11444808B1 ## CPC - H04L 12/4641: {Virtual LANs, VLANs, e.g. virtual private networks [VPN] (LAN interconnection over a bridge based backbone H04L12/462; encapsulation techniques H04L12/4633; routing of packets H04L45/00; packet switches H04L49/00; virtual private networks for security H04L63/0272)} - H04L 61/2514: between local and global IP addresses - H04L 61/256: NAT traversal - H04L 61/5007: Internet protocol [IP] addresses - H04L 61/2517: using port numbers - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract According to one embodiment, a computerized method conducted by logic deployed within a network device implemented within a virtual private cloud network for supporting network address translations within a public cloud network is described. Herein, after receipt of a message, based on content within the message, a network address translation (NAT) control logic unit from a plurality of NAT control logic units is selected. The selected NAT control logic unit is configured to perform address translations on information within the message to produce a translated message. Thereafter, the translated message is routed to a destination network device located on the public network. ## Claims ### Claim 1 A computerized method for supporting network address translations within a public cloud network, the method comprising: receiving a message; based on content of the message, selecting a network address translation (NAT) control logic unit from a plurality of NAT control logic units to perform address translations on information within the message, the selecting of the NAT control logic unit comprises conducting one or more hash-type functions on at least a source private Internet Protocol (IP) address or a source port of a header section of the message to produce a result for use in determining the selected NAT control logic unit; routing the message to the selected NAT control logic unit to produce a translated message; and routing the translated message to a destination network device located on a public network. ### Claim 2 (depends on 1) The computerized method of claim 1, wherein each of the plurality of NAT control logic units corresponds to a virtual machine instance. ### Claim 3 (depends on 1) The computerized method of claim 1, wherein the message is received from a source deployed within a virtual private cloud network. ### Claim 4 (depends on 3) The computerized method of claim 3 further comprising: receiving a return message from the destination network device; and performing one or more address translations on content of the return message prior to forwarding a translated return message back to the source. ### Claim 5 (depends on 1) The computerized method of claim 1, wherein the result is produced based on the one or more hash-type functions, including a modulo operation, being conducted on a source private Internet Protocol (IP) address or a source port within the header section of the message. ### Claim 6 (depends on 1) The computerized method of claim 1, wherein the result is produced based on the one or more hash-type functions, including a Message Digest based hash operation. ### Claim 7 (depends on 1) The computerized method of claim 1, wherein a private source address of the translated message includes a public IP address of the selected NAT control logic unit. ### Claim 8 (depends on 1) The computerized method of claim 1, wherein a source port of the translated message includes a selected port from one or more ports managed by the selected NAT control logic unit. ### Claim 9 A computerized method conducted by logic deployed within a network device implemented within a virtual private cloud network for supporting network address translations within a public cloud network, the method comprising: receiving a message; based on content within the message, selecting a network address translation (NAT) control logic unit from a plurality of NAT control logic units, wherein the selecting of the NAT control logic unit comprises conducting one or more hash-type functions on at least a source private Internet Protocol (IP) address or a source port of a header section of the message to produce a result for use in determining the selected NAT control logic unit and the selected NAT control logic unit to perform address translations on information within the message to produce a translated message; and routing the translated message to a destination network device located on the public network. ### Claim 10 (depends on 9) The computerized method of claim 9, wherein each of the plurality of NAT control logic units corresponds to a virtual machine instance. ### Claim 11 (depends on 9) The computerized method of claim 9, wherein the message is received from a source deployed within a virtual private cloud network. ### Claim 12 (depends on 11) The computerized method of claim 11 further comprising: receiving a return message from the destination network device; and performing one or more address translations on content of the return message prior to forwarding a translated return message back to the source. ### Claim 13 (depends on 9) The computerized method of claim 9, wherein the result is produced based on the one or more hash-type functions, including a modulo operation, being conducted on a source private Internet Protocol (IP) address or a source port within the header section of the message. ### Claim 14 (depends on 9) The computerized method of claim 9, wherein the result is produced based on the one or more hash-type functions, including a Message Digest based hash operation. ### Claim 15 (depends on 9) The computerized method of claim 9, wherein the private source address of the translated message includes a public IP address of the selected NAT control logic unit. ### Claim 16 (depends on 9) The computerized method of claim 9, wherein the source port of the translated message includes a selected port from one or more ports managed by the selected NAT control logic unit. ### Claim 17 A non-transitory storage medium including software executed by logic within a virtual private cloud network for supporting network address translations within a public cloud network, comprising: a first software module, when executed by the logic, selects a network address translation (NAT) control logic unit from a plurality of NAT control logic units by at least conducting one or more hash-type functions on at least a source private Internet Protocol (IP) address or a source port of a header section of the message to produce a result for use in determining the selected NAT control logic unit, wherein the selected NAT control logic unit to perform address translations on information within the message to produce a translated message; and a second software module, when executed by the logic, routes the translated message to a destination network device deployed as part of the public cloud network. ### Claim 18 (depends on 17) The non-transitory storage medium of claim 17, wherein each of the plurality of NAT control logic units corresponds to a virtual machine instance. ### Claim 19 (depends on 17) The non-transitory storage medium of claim 17, wherein the first software module selects the NAT control logic unit based, at least in part, on a message is received from a source deployed within a virtual private cloud network.