Patent ID: 7853952

Claim:
A method, comprising: receiving, at a network device, a packet of a data flow between a first host and a second host; determining, relative to the network device, which of the first and second hosts is an inside host and which of the first and second hosts is an outside host; accessing a memory space comprising a plurality of partition objects, wherein the plurality of partition objects includes one or more dynamic partition objects, each one of the one or more dynamic partition objects having at least one attribute defining a first allocation of network bandwidth across all data flows associated with the one of the one or more dynamic partition objects and a side parameter indicating which of the inside and outside host is a user, and a second attribute defining user partition allocations of the network bandwidth within the first allocation; selecting a partition object from the plurality of partition objects based on one or more attributes of the data flow; and if the selected partition object is a dynamic partition object, identifying either the first or second host as a user based on the side parameter of the selected dynamic partition object; creating, if no user partition object exists for the identified user, a user partition object as a child of the selected dynamic partition object in the memory space for the identified user, wherein the user partition object is accessible by a data flow control mechanism to allocate utilization of the network bandwidth within the first allocation, according to the second attribute defined in the selected dynamic partition object, across all data flows associated to the selected dynamic partition object and the identified user.