Patent ID: 7808911

Claim:
A method for protecting a Network Service Provider (NSP) data network that provides connectivity to users, against data overflow, comprising: a) dividing said NSP data network to a first sub-network being a protected region within said NSP data network and a second unprotected sub-network within said NSP data network, such that connectivity to external data networks is allowed through said second sub-network via a set of predefined controlled data ports; b) connecting each user to said first sub-network via a proxy router; c) connecting each user to said second sub-network via one or more gateway routers that are connected to said proxy router through interconnected intermediating routers and to said second sub-network via said set of controlled data ports; d) for each user, determining a maximum available bandwidth that can be processed by said user; e) allocating maximal sub-bandwidth for each router, such that said maximal sub-bandwidth is equal to, or smaller than, said maximal available bandwidth of each user; whenever the data packet flow intended to said user exceeds said sub-bandwidth at one of said routers: f) filtering the excess packet flow according to predetermined criteria defined by said user; g) sending to said user a report about the filtered packets within a predetermined period after said filtering begins; h) allowing said user to change said criteria and/or said bandwidth in real time; otherwise, i) passing said data packet flow from each router to the next router until the proxy router.