Configurable Modular Networking System and Method Thereof

[0001] The present invention generally relates to a networking system, more particularly relates to a configurable modular networking system that provides flexible expandability on a single platform.

[0002] The continual improvement of technology within the networking industry is well known in the art. The industry is constantly trying to expand on current networking technology as well as develop alternative technology with corresponding advantages over more traditional networking technology. In response, protocols and standards are created and updated in order to ensure that both a compatibility and performance levels are maintained within the industry. Within this environment, it is difficult to maintain an up-to-date, diverse networking enterprise.

[0003] The infrastructure in a large enterprise containing both computer systems and networks of different types is very complex. This complexity increases as the number of different networking types, standards, and protocols integrated within an enterprise increases. Complicated function such as protocol conversion, security maintenance, and inter/intra-networking management must occur at a large number of networking interfaces within the enterprise. As a result, the design and actual implementation of an enterprise requires both a large expenditure of time and money. However, as networking technology changes, this design may quickly become obsolete. Due to the complexity of enterprise infrastructures, upgrading an obsolete infrastructure is generally very costly as well. In fact, oftentimes, networking devices (e.g., gateways, bridges, and routers) are discarded and replaced with versions containing newer technology. In addition, MIS people have to relearn the network operation each time when the infrastructure is updated. As a result, the cost of maintaining a stable enterprise is usually very high; frequently higher than the initial design and implementation costs. Nowhere is this problem more relevant than in the office networking arena.

[0004] The OSI, or Open System Interconnection, model defines a networking framework for implementing protocols in seven layers. Control is passed from one layer to the next, starting at this application layer in one station, proceeding to the bottom layer, over the channel to the next station and back up the hierarchy.

[0005] Physical Layer (Layer 1): This layer conveys the bit stream—electrical impulse, light or radio signal—through the network at the electrical and mechanical level. It provides the hardware means of sending the receiving data on a carrier, including defining cables, cards and physical aspects. Fast Ethernet, RS232, and ATM are protocols with physical layer components.

[0006] Data Link Layer (Layer 2): At this layer, data packets are encoded and decoded into bits. It furnishes transmission protocol knowledge and management and handles errors in the physical layer, flow control and frame synchronization. The data link layer is divided into two sublayers: The Media Access Control (MAC) layer and the Logical Link Control (LLC) layer. The MAC sublayer controls how a computer on the network gains access to the data and permission to transmit it. The LLC layer controls frame synchronization, flow control and error checking.

[0007] Network Layer (Layer 3): This layer provides switching and routing technologies, creating logical paths, known as virtual circuits, for transmitting data from node to node. Routing and forwarding are functions of this layer, as well as addressing, internetworking, error handling, congestion control and packet sequencing.

[0008] Transport Layer (Layer 4): This layer provides transparent transfer of data between end systems, or hosts, and is responsible for end-to-end error recovery and flow control. It ensures complete data transfer.

[0009] Session Layer (Layer 5): This layer established, manages and terminates connections between applications. The session layer sets up, coordinates, and terminates conversations, exchanges, and dialogues between the applications at each end. It deals with session and connection coordination.

[0010] Presentation Layer (Layer 6): This layer provides independence from differences in data representation (e.g., encryption) by translating from application to network format, and vice versa. The presentation layer works to transform data into the form that the application layer can accept. This layer formats and encrypts data to be sent across a network, providing freedom from compatibility problems. It is sometimes called the syntax layer.

[0011] Application Layer (Layer 7): This layer supports application and end-user processes. Communication partners are identified, quality of service is identified, user authentication and privacy are considered, and any constraints on data syntax are identified. Everything at this layer is application-specific. This layer provides application services for file transfers, e-mail, and other network software services. Telnet and FTP are applications that exist entirely in the application level. Tiered application architectures are part of this layer.

[0012] Office often requires additional or stricter network function, among the Layers of the OSI model, above those offered in more traditional networks. For example, certain businesses may require a high level of security within their network to protect valuable data. Additionally, businesses may require certain network management function in order to properly operate within an office environment. These various functionality levels within different interfacing networks further increase the complexity of an enterprise infrastructure containing these networks.

[0013] Networking technologies in this market place have been changing at a rapid place in order to satisfy the bandwidth and the network functionalities within the office networking arena. Specifically, networks and corresponding enterprises must be upgraded in order to incorporate these technology advances. This upgrade is typically very expensive due to the price of the new networking devices, the cost of training the MIS people, as well as the cost in integrating these devices within existing infrastructures.

[0014] According to one aspect of the present invention, it is one objective of the present invention to provide an expandable, configurable networking device capable of providing flexible network functionalities on a single platform through configuration by the module keys instead of intrinsic software on the platform. By this way, a configurable modular platform will not perform any function until is told by the keys to do so such that said platform can be kept as a unified platform with versatile modules.

[0015] According to another aspect of the present invention, one of the objectives is to provide configurable modular network system that is not discarded as the infrastructure expands. Instead, modules or keys will be upgraded to update the whole system.

[0016] According to another aspect of the present invention, it is another objective of the present invention to include appropriate network function within the bus and allow these network functions to grow or contract as a network's needs change.

[0017] A configurable modular networking system, comprising:

[0018] A CPU coupling to a bus, said CPU is adapted to manage said networking system.

[0019] A communication IC coupling to said bus, said bus is adapted to provide a path between said CPU and said communication IC, and said communication IC is adapted to provide a plurality of network function modules.

[0020] A first memory device coupling to said communication IC and/or said CPU, said first memory device is adapted to store at least one hardware key. Each of said hardware keys corresponds to at least one of the network function modules of said communication IC.

[0021] A second memory device coupling to said CPU, said second memory device is adapted to store software modules. Each of said software module comprises at least one software function. Said second memory device is further adapted to store at least one software key. Each of said software keys corresponds to at least one of said software modules.

[0022] And at least one hardware module interface coupling to said communication IC; said hardware module interface is adapted to provide a plurality of functions can be added. Each of said hardware modules comprises at least one secret key.

[0023] The configurable modular networking system of further comprises: at least one general network module can be coupled to said bus of claim 3, each general network module comprising at least one general module key, wherein said general network modules can be configured by said general module keys.

[0024] Wherein:

[0025] The network function modules are configured and enabled by the hardware keys. The software modules are enabled by the software keys. The hardware modules are enabled by the secret keys. The general network modules are enabled by the general module keys. Thus, the software modules, network function modules, hardware modules and general network modules are configurable by varies combinations of said software keys, hardware keys, secret keys and general module keys.

[0026] FIG. 1 is a block diagram of an embodiment of the present invention;

[0027] FIG. 2 is a more detailed block diagram of said embodiment of the present invention;

[0028] FIG. 3 is a block diagram of a preferred embodiment according to the principles of the present invention;

[0029] FIG. 4 is another block diagram of a preferred embodiment according to the principles of the present invention;

[0030] FIG. 5 is a flowchart of the procedure for upgrading the function of the embodiment of this present invention;

[0031] FIG. 6 is a flowchart of the procedure for upgrading hardware modules;

[0032] FIG. 7 is a flowchart of the procedure for upgrading function modules of said communication IC; and

[0033] FIG. 8 is a flowchart of the procedure for upgrading function of the software modules.

[0034] A configurable modular networking system and corresponding methods are described. In the following description, for purposes of explanation, numerous specific details are set forth in order to provide a thorough understanding of the invention. It will be apparent, however, to one skilled in the art that the invention can be practiced without these specific details. In other instances, structures and devices are shown in block diagram form in order to avoid obscuring the invention.

[0035] Reference in the specification to “one embodiment” or “an embodiment” means that a particular feature, structure or characteristic described in connection with the embodiment is included in at least one embodiment of the invention. The appearances of the phrase “in one embodiment” in various places in the specification are not necessarily all referring to the same embodiment.

[0036] Unless specifically stated otherwise as apparent from the following discussion, it is appreciated that throughout the description, discussions such as “processing” or “computing” or “determining” or “switching” or “converting” or the like, refer to the action and process of a computing system or networking system that manipulates and transforms data represented as physical (electronic) quantities within the system's registers and memories into other data similarly represented as physical quantities within the system registers or memories or other such information storage, transmission or display devices.

[0037] It should be noted that the language used in this disclosure has been principally selected for readability and instructional purposes, and may not have been selected to delineate or circumscribe the inventive subject matter, resort to the claims being necessary to determine such inventive subject matter.

[0038] FIG. 1 is a block diagram of an embodiment of the present invention. In this embodiment of a configurable modular networking system 10 comprises:

[0039] A CPU 101 coupling to a bus 102, said CPU 101 is adapted to manage said networking system 10.

[0040] A communication IC 103 coupling to said bus 102, said bus 102 is adapted to provide a path between said CPU 101 and said communication IC 103. Such communication IC 103 is adapted for embedding a plurality of network function modules 1031.

[0041] A hardware module interface 104 coupling to said communication IC 103, said hardware module interface 104 is adapted to provide a plurality of interfaces 1041 where a plurality of hardware modules 109 can be coupled which provide expandability to said system. Each of said hardware modules 109 comprises a secret keys 1091, 1092, 1093, 109n corresponding to their functionalities.

[0042] A first memory 107 coupling to said communication IC 103 and/or CPU 101, said first memory 107 is adapted to store a hardware key 1071. Said hardware key 1071 corresponds to at least one of said network function Modules 1031 embedded in the Communication IC 103.

[0043] And a second memory 105 coupling to said CPU 101, said second memory 105 is adapted to store a plurality of software modules 1051 corresponding to said network function modules 1031 embedded in said communication IC 103 and also corresponding to said hardware modules 109. Each of said software modules 1051 comprises at least one software function corresponding to said network function modules 1031 or said hardware modules 109. Said second memory device 105 is further adapted to store a software key 1052. Said software key 1052 corresponds to at least one function of said software modules 1051.

[0044] Wherein:

[0045] By coupling said hardware modules 109 to said hardware module interface 104, and the corresponding secret keys 1091, 1092, 1093, 109n are verified by said CPU 101 and/or said communication IC 103 as valid secret keys, said hardware modules 109 are enabled.

[0046] By replacing the hardware key with a new hardware key 1071 in said first memory device 107, and such new hardware key is verified by said CPU 101 and/or said communication IC 103 as a valid hardware key 1071, the corresponding network function modules 1031 embedded in said communication IC 103 are enabled.

[0047] And by replacing the software keys with a new software key 1052 in said second memory device 105, and such new software key is verified by said CPU 101 and/or said communication IC 103 as a valid software key, the corresponding software modules 1501 are enabled.

[0048] FIG. 2 is a more detailed block diagram of the embodiment of the present invention. As shown in FIG. 2, besides being a path between said CPU 101 and said communication IC 103, the bus 102 may also be implemented as an standard bus 202 according to industrial standards, such as PCI bus, mini-PCI bus, PCI-X bus, PCI Express bus, SPI-3 bus and so on. As a result, general network modules 206, i.e. interface cards, may be coupled to the standard bus 202 to expand the functionality of said system 10, such as VPN card, content filtering card, IPS card, etc. Said general network modules 206 may have their own access interfaces coupling to different types of networks, network modules also may have said general module keys 2061 to indicated the functionalities associated with said system 10.

[0049] An interface 208 within a plurality of access interfaces may be coupled to said communication IC 103. Said interface 208 may be coupled to a network for transmitting and receiving packets from said network.

[0050] The hardware module interface 104, as shown in FIG. 1, may be implemented as a bus bridge/switching fabrics 204 with “bus bridge chips” (e.g. PCI Bridge, PCI-X Bridge, SP13 Bridge, or even custom designed chipsets) or “switch chip”. Said bus bridge/switching fabrics 204 collaborating with said communication IC 103 provide higher performance than said industrial standard bus 202.

[0051] Said communication IC 103 may be a proprietary networking ASIC chipset. A plurality of firmware information and/or driver corresponding to said hardware modules 109 may be embedded in said communication IC 103. As a result, while coupling hardware modules 109 to said hardware module interface 204, the hardware modules are automatically operable with simpler configuration efforts. Some of said hardware modules 109 may also have their own access interfaces for coupling to different types of networks, such as fast Ethernet, Cable modem, xDSL, optical fiber network and wireless LAN.

[0052] FIG. 3 is a block diagram of a preferred embodiment according to the principles of the present invention, comprising:

[0053] A CPU 101 coupling to a PCI bus 302, said CPU 101 is adapted to manage said networking system 30. A plurality of co-processors 3011 coupling to said CPU 101. Said co-processors 3011 are adapted to collaborate with said CPU 101 to manage said networking system 30. A communication IC 103 coupling to said PCI bus 302, said PCI bus 302 is adapted to provide a path between said CPU 101. Said PCI bus 302 further provides a plurality of slots where general network modules 306, i.e. PCI interface cards, may be coupled for expanding the functionality of said system 30. Said general network modules 306 may have their own access interfaces coupling to different types of networks, such as fast Ethernet, Cable modem, xDSL and wireless LAN. Said communication IC 103 may be a proprietary networking ASIC chipset, which is adapted to provide a plurality of network function modules, comprising:

• • [0054] A. Network security function modules, including: wire-speed Stateful Firewall, DoS/DDoS prevention, IDS/IPS, Content Security, Policy-based AAA (Authorization, Authentication, Accounting), WLAN Security, etc.
  • [0055] B. Broadband gateway function modules, including: NAT/NAPT, policy-based subscriber accounting, authorization and authentication, bandwidth management, multi-ISP supporting and switching, flow control, flow monitoring, QoS customization, customization of charging policy based on service, etc. And
  • [0056] Switching/routing function modules, including: wire-speed layer two to layer five of the OSI module switching/policy routing, rate control, multi-policy of QoS, flow classification, flow control/management, session rate control/management, multicast routing, policy routing and redirection, remote monitoring, etc.

[0057] A FLASH memory 307 coupling to said communication IC 103 and/or CPU101, said FLASH memory 370 is adapted to store a hardware key 3071. Said hardware key 3071 corresponds to at least one of said network function modules 1031 embedded in said communication IC 103 described above.

[0058] An interface 308 within a plurality of access interfaces, e.g. m Fast Ethernet ports and n Gigabit Ethernet ports (m,n=integer), coupling to said communication IC 103, said interface 308 is adapted to couple to a network for transmitting and receiving packets from said network.

[0059] A hardware module interface implemented with a custom designed chipset, say, AceNet Bus/AceNet Fabrics 304, coupling to said communication IC 103, said AceNet Bus/AceNet Fabrics 304 is adapted to provide a plurality of interfaces where a plurality of hardware modules 3091, 3092, 3093, 3094, may be connected so that additional function can be added. Said AceNet Bus/AceNet Fabrics 304 collaborating with said communication IC 103 may provide higher performance than said PCI bus 302. Said communication IC 103 is further adapted to embed a plurality of firmware and drivers for hardware modules 3091, 3092, 3093, 3094, such that hardware modules (e.g. Wireless LAN module 3091, Content Filter module 3092. VPN module 3093, Optical module 3094. Ethernet module 3095) coupling to said AceNet Bus/AceNet Fabrics 304 may automatically operable without manual configuration efforts (e.g., Plug-and-Play).

[0060] An EEPROM (and/or flash memory) 305 coupling to said CPU 101, said EEPROM 305 is adapted to store a plurality of software modules 3051. Said software modules 3051 corresponds to said network function modules 1031 of said communication IC 103 and said hardware modules 109 (e.g. Wireless LAN module 3091, Content Filter module 3092, VPN module 3093, Optical module 3094, Ethernet module 3095). Said EEPROM (or flash memory) 305 is further adapted to store a software key 3052. Said software key 3052 corresponds to at least one of said software modules 3051.

[0061] A Wireless LAN module 3091 coupling to said AceNet Bus/AceNet Fabrics 304, said Wireless LAN module 3091 is adapted to provide wireless interface 30912 to couple to a wireless network for transmitting and receiving packets from said wireless network. Said Wireless LAN module 3091 comprises a secret key 30911.

[0062] A content Filter module 3092 coupling to said AceNet Bus/AceNet Fabrics 304. Said Content Filter module 3092 is adapted to provide analysis and isolation as well as further operation of packets according to their content. Said content Filter module 3092 comprises a secret key 30921.

[0063] A virtual private network (VPN) module 3093 coupling to said AceNet Bus/AceNet Fabrics 304, said VPN module 3093 is adapted for implementing a virtual private network. Said virtual private network (VPN) module 3093 comprises a secret key 30931.

[0064] An optical filter module 3094 coupling to said AceNet Bus/AceNet Fabrics 304, said optical fiber module 3094 is adapted to provide an optical fiber access interface 30942 coupling to an optical network for transmitting and receiving packets from said network. Said optical fiber module 3094 comprises a secret key 30941.

[0065] An Ethernet module 3095 coupling to said AceNet Bus/AceNet Fabrics 304, said Ethernet module 3095 is adapted to provide an Ethernet access interface coupling to an Ethernet network for transmitting and receiving packets from said network. Said Ethernet module 3095 comprises a secret key 30951.

[0066] Wherein,

[0067] By coupling said hardware modules (e.g. Wireless LAN module 3091, Content Filter module 3092, VPN module 3093, Optical module 3094, Ethernet module 3095) to said AceNet Bus/AceNet Fabrics 304, and the corresponding secret keys 30911, 30921, 30931, 30941, 30951 are verified by said CPU 101 and/or said communication IC 103 as valid secret keys, said hardware modules 3091, 3092, 3093, 3094, 3095 are enabled.

[0068] By replacing said hardware key 3071 with an updated key, the new key will be verified by said CPU 101 and/or said communication IC 103 as a new valid hardware key. Thus, the corresponding network function modules embedded in said communication IC 103 are enabled.

[0069] By replacing said general module key 3061 with an new one, the new key will be verified by said CPU 101 and/or said communication IC 103 as a new valid general module key. Thus, the corresponding function said general network modules are enabled.

[0070] Similarly, by replacing said software key 3052 with an new one, the new key will be verified by said CPU 101 and/or said communication IC 103 as a new valid software key. Thus, the corresponding function said software modules are enabled.

[0071] Further, said software key 3052 further corresponds to hardware modules Wireless LAN module 3091, Content Fiber module 3092, VPN module 3093, Optical module 3094, Ethernet module 3095, and all of said network function modules 1031. Said hardware key 3701 further corresponds to all of said software modules 3051, network function modules 1031, and hardware modules 309, including Wireless LAN module 3091, Content Filter module 3092, VPN module 3093, Optical module 3094, Ethernet module 3095, And said secret keys 30911, 30921, 30931, 30941, 30951 further correspond to all software modules 3051 and all network function modules 1031. Wherein all software modules 3051, all network function modules 1031 and hardware modules 309, including Wireless LAN module 3091, Content Filter module 3092, VPN module 3093, Optical module 3094, Ethernet module 3095 are enabled or disabled by said CPU 101 and/or communication IC 103 according to the corresponding software key 3052, hardware key 3071, general module key 3061 and secret keys 30911, 30921, 30931, 30941, 30951 presented in said system. Said software key 3052, said hardware key 3071, general module key 3061 and said secret keys 30911, 30921, 30931, 30941, 30951 may be expired in a predetermined period of time, such that the corresponding functions are disable and require a new valid “key”. Said software key 3052, said hardware key 3071, general module key 3061 and said secret keys 30911, 30921, 30931, 30941, 30951 may further be encrypted to enhance the security of said system. In short, all of the functions inside the networking system 30, including the software modules 3051, the network function module 1031, the general network module 306 and the hardware modules 309, may be activated or deactivated by said CPU 101 and/or said communication IC 103 according to the information stored in the “keys”.

[0072] FIG. 4 is a block diagram of another preferred embodiment according to the principles of the present invention. In this embodiment, the configurable modular networking system may comprise: a networking system platform 410 with a system core 411, a network chipset 412, a first backplane 413, a second backplane 414, a third backplane 415 and at least one secret key. The system core 411 is generally consisted of a platform CPU 4111 and memory 4112, as known to the person skilled in the art. The platform CPU may be further implemented with a plurality of CPUs to increase the power of the system core 411. The first backplane 413 may work as a “bus” which delivers various data values, instructions, and information from the system core 411 to all the devices and components inside the network system 400 and vice versa, as well as the different peripherals and devices attached. The first backplane 413 may be implemented with several kinds of buses including PCI bus, PCI express, CPCI bus, SP13, etc. Because the first backplane 413 is configured to compatible with the standard interface cards, standard interface modules 422 may be coupled to provide extra functionalities to the network system 400. But one fact must be mentioned is that the speed of the standard modules 422 is usually limited by the speed of the first backplane 413. Inside the network system 400, the network chipset 412 may be coupled to the first backplane 413 as a network “accelerator”, which provides full or most Layer 2 to Layer 4 network capabilities and partial Layer 5 to Layer 7 network function including, but not limited to, WLAN Security, NAT/NAPT, VPN support, content filtering, bandwidth management, multi-ISP supporting and switching, flow control, flow monitoring, QoS customization, customization of billing policy based on service, wire-speed layer two to layer four switching/policy routing, rate control, multi-policy of QoS, flow classification, flow control/management, session rate control/management, multicast routing, policy routing and redirection and remote monitoring. The second backplane 414 may be coupled to the network chipset 412 to provide interfaces for traffic interface modules 431, 432, 433. Almost all network traffic may be delivered into or out of the network system 400 via those traffic interface modules 431, 432, 433. Each of the traffic interface modules 431, 432, 433 may be compatible with different types of traffic interfaces including but not limited to fast Ethernet ports, Gigabit Ethernet ports, fiber optical ports, and wireless ports. Users or enterprises may install different traffic interface modules 431, 432, 433 according to their need. The third backplane 415 may be coupled to the network chipset 412 to provide interfaces for function modules 441, 442, 443, such that function modules 441, 442, 443 may be coupled to provide extra functionalities to the network system 400. Because the network chipset 412 provides only partial Layer 5 to Layer 7 functions and might not completely support the Layer 2 to Layer 4 functions, these function modules 441, 442, 443 may provide the expandability and the upgradeability for the network system 400 to provide any other functionalities that is not supported in the network chipset 412. These functions of modules 441, 442, 443 may include, but not limited to, all kinds of content based functions, VPN, Anti-virus, Firewall, DoS/DDoS prevention, IDS/IPS, Content Security, Policy-based AAA (Authorization, Authentication, Accounting), WLAN Security, NAT/NAPT, policy-based subscriber authorization and authentication, bandwidth management, QoS customization, customization of billing policy based on service, multi-policy of QoS, policy routing and redirection, and remote monitoring. In one embodiment, the third backplane 415 may be implemented with a high-bandwidth switching fabric (e.g. gigabit) and each of the function modules 441, 442, 443 may further comprise, if necessary, an adaptor 4412, 4422, 4432 such that traffic or proprietary data may be transferred between the system platform 410 and the function modules 441, 442, 443. There may be several secret keys 4211, 4311, 4321, 4331, 4411, 4421, and 4431 in this network system 400. In this embodiment, a hardware key module 421 coupling to the first backplane 413 may be implemented to store a secret key 4211. Secret keys 4311, 4321, and 4331 may be integrated into the traffic interface modules 431, 432, 433. And, Secret keys 4411, 4421, and 4431 may be integrated with the function modules 441, 442, and 443. The purpose of these secret keys 4211, 4311, 4321, 4331, 4411, 4421, 4431 is to provide information for the system core 411 to decide witch function to be activated.

[0073] Referring to FIG. 5, a flowchart of configuring the function of one embodiment of this present invention, in this embodiment, the procedure comprises the following steps.

[0074] Check if an additional hardware module is required S101; if it does, initiate the procedure for configuring hardware modules S103, if not, go to the next step.

[0075] Check if an additional network function module is required S102, if it does, initiate the procedure for configuring network function modules of the communication IC S104, if not, go to the next step.

[0076] Initiate the procedure for configuring software modules S105.

[0077] And finally, enable hardware modules, network function modules and software modules according to the keys, i.e., secret keys, hardware keys and software keys.

[0078] Referring to FIG. 6, a flowchart of the procedures for configuring hardware modules S103, comprising:

[0079] Couple a hardware module to said hardware module interface S201.

[0080] Initiate said hardware module S202.

[0081] Verify the secret key of said hardware module S203.

[0082] Determine if said secret key is valid S204.

[0083] Set the corresponding hardware module, network function modules, general network module and software modules of the verified secret key ready to be enabled S205.

[0084] For example, a wireless module is coupled to said hardware module interface. Said wireless module is adapted to provide wireless access interface coupled to a wireless network which transmits packets to said wireless network and receives packets from said wireless network. In this example, additional wireless access interface may be necessary for upgrading such function.

[0085] For another example, a content filter module is coupled to said hardware module interface. Said Content Filter module is adapted to provide analysis and isolation as well as further operation of packets according to their content. In this example, additional content filtering engine may be necessary for upgrading such function.

[0086] For another example, a virtual private network module is coupled to said hardware module interface. Said virtual private network module is adapted for implementing a virtual private network function. In this example, additional encryption module and Ethernet access interfaces may be necessary for upgrading such function.

[0087] Referring to FIG. 7, a flowchart of the procedure for configuring function modules of said communication IC S104, comprising the following steps:

[0088] Store at least one hardware key in said first memory device S301.

[0089] Verify said hardware keys S203.

[0090] Determine if said hardware keys are valid S303.

[0091] Set the corresponding hardware modules, network function modules and software modules of the verified hardware keys ready to be enabled S304.

[0092] For example, function modules of said communication IC those are enabled/disenabled by said hardware key comprises:

[0093] Network security function includes, but not limited to, Firewall, Application Firewall, VPN, DoS/DDoS prevention, IDS/IPS, Content Security, Policy-based AAA (Authorization, Authentication, Accounting) Anti-Virus, Anti-Span, URI, blocking, WLAN Security, etc;

[0094] Broadband gateway function includes, but not limited to, NAT/NAPT, policy-based subscriber authorization and authentication, bandwidth management, multi-ISP supporting, flow control, flow monitoring, load balancing, QoS customization, customization of billing policy based on service, etc; and

[0095] Switching/routing function including wire-speed layer two to layer four of the OSI model switching/policy routing, rate control, multi-policy of QoS, flow classification, flow control/management, session rate control/management, multicast routing, policy routing and redirection, and remote monitoring.

[0096] Referring to FIG. 8, a flowchart of the procedure for configuring software modules S105, comprising the following steps:

[0097] Establish connection with the configurable modular networking system through a computer network S401.

[0098] Store at least one key in said second memory device S402.

[0099] Verify said keys S403.

[0100] Determine if said keys are valid S404.

[0101] Set the corresponding hardware module, network function modules and software modules ready to be enabled by the verified keys S405.

[0102] While the present invention has been described with reference to certain preferred embodiments, those skilled in the art will recognize that various modifications may be provided. Variations upon and modifications to the preferred embodiments are provided for by the present invention, which is limited only by the following claims.