WO2008083168A1

WO2008083168A1 - Method for code execution

Info

Publication number: WO2008083168A1
Application number: PCT/US2007/088839
Authority: WO
Inventors: Ron Lapedis; Arrigo Triulzi
Original assignee: Sandisk Corporation
Priority date: 2006-12-29
Filing date: 2007-12-26
Publication date: 2008-07-10
Also published as: TW200837630A; TWI367449B

Abstract

Method for executing a software application is provided. The method includes detecting a host operating system; executing a virtual operating system in a virtual environment, wherein the virtual operating system is stored in a non-volatile memory device; and executing a software application in the virtual environment, wherein the software application is stored in the non-volatile memory device; and the virtual operating system and the software application are executed independently of the host operating system execution.

Description

ATTORNEY DOCKET NO.: SDK0854.PCT

METHOD FOR CODE EXECUTION

Inventors: Ron LaPedis Arrigo Triulzi BACKGROUND

1. Technical Field

[0001] The present disclosure relates to computing systems, and more particularly, to code execution.

2. Related Art [0002] Computing systems (stand-alone and networked) are commonplace. The Internet has increased the popularity of electronic commerce, where users of computing systems conduct millions of electronic transactions. This increase in popularity has also made computing systems and user information vulnerable to pirates (sometimes known as "hackers"). [0003] Operating systems are computer programs used to perform certain computing tasks, such as, for example, managing input/output tasks, peripheral devices (for example, storage devices) and file systems. Operating systems provide a software platform on top of which other software applications are written. Software applications are used for various tasks, including, for example, word-processing, electronic mail (email) and Internet browsing. Some common operating systems include Windows⁸, Linux*, IBM* OS/2, MacOS. UNIX, and MS-DOS.

[0004] Many operating systems are pirated (or "hacked," i.e.. they experience unauthorized use or interruption) through use of disruptive software programs, such as ATTQENEX DOCKET NO.: SDK0854.PCT

those known as computer viruses, worms, key-loggers, and root-kits. Securing operating systems and overall application code execution is a challenge. [0005] Furthermore, software applications will often ran on multiple operating systems or hardware platforms. Typically, separate code for a software application must be created for each different environment/platform. This is expensive and undesirable. An efficient method and system are desirable for managing code for software applications to be used on different hardware and software platforms.

SUMMARY

[0006] In one embodiment, a non- volatile memory device is provided. The non- volatile memory comprises a plurality of memory cells, wherein a read only segment of a plurality of memory cells stores (a) code for a micro-operating system for running a virtual engine; (b) code for the virtual engine that provides a virtual environment, independent of a host operating system; (c) code for a virtual operating system that is executed in the virtual environment; and (d) code for a software application, wherein the code for the software application can be executed in different host system platforms in the virtual environment.

[0007] In another embodiment, a system for code execution is provided.. The system comprises a host computing system; and a non-volatile memory device operationally coupled to the host computing system, the non-volatile memory device comprising a plurality of memory cells, wherein a read only segment of a plurality of memory cells stores: (a) code for a micro-operating system for running a virtual engine; (b) code for the virtual engine that provides a virtual environment, independent of a host operating system; (c) code for a virtual operating system that is executed in the virtual environment; ATTORNEY DOCKET NO.: SDK0854. PCT

and (d) code for a software application, wherein the code for the software application can be executed in different host system platforms in the virtual environment. [0008] In yet another embodiment of the present disclosure, a method for executing a software application is provided. The method includes detecting a host operating system; executing a virtual operating system under a virtual engine, wherein the virtual operating system and the virtual engine are stored in a non- volatile memory device: and executing a software application in a virtual environment, wherein the software application is stored in the non-volatile memory device. The virtual operating system and the software application are executed independently of the host operating system execution. [0009] In another embodiment of the present disclosure, a method for executing a software application is provided. The method includes authenticating a non-volatile memory device coupled to a host system; detecting a host operating system by the nonvolatile memory device; executing a virtual operating system under a virtual engine. wherein the virtual operating system and the virtual engine are stored in a read only segment of the non- volatile memory device; and executing the software application in a virtual environment, wherein the software application is stored in a read-only segment of the non-volatile memory device. The virtual operating system and the software application are executed independently of the host operating system execution. [0010] This brief summary is not intended to limit the disclosure to any particular embodiment. Rather, the disclosure is intended to cover the subject matter defined by the claims appended hereto, and all equivalents. ATTORNEY DOCKET NO . : SDK0854. PCT

BRIEF DESCRIPTION QF THE DRAWINGS

[0011] The foregoing features and other features will now be described with reference to the drawings of a preferred embodiment, In the drawings, the same components have the same reference numerals. The illustrated embodiments are intended to illustrate, but not to limit the disclosure. The drawings include the following Figures:

[0012] Figure IA shows a block diagram of a computing system of an embodiment; [0013] Figure IB shows a block diagram of a memory controller in Figure IA, [0014] Figure 1C shows a top-level block diagram of a system of an embodiment for authenticating a non- volatile memory device;

[0015] Figure ID shows a block diagram of a software architecture of an embodiment; and

[0016] Figure 2 shows a process flow diagram of an embodiment. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0017] To facilitate an understanding of the preferred embodiment, the general architecture and operation of a computing system/non- volatile memory storage device will first be described. The specific architecture and operation of the preferred embodiment will then be described with reference to the general architecture. [0018] Figure IA shows a block diagram of a typical computing system (may also be referred to as "host system" or "host") 100 that includes a central processing unit ("CPU") (may also be referred to as microprocessor/processor) 101 operationally coupled to a system bus 101B. Random access memory ("RAM") 103 provides CPU 101 with ATTORNEY DOCKET NO.: SDK0854.PCT

access to memory storage. When executing program instructions, CPU 101 stores those process steps (code) in RAM 103 and executes the stored process steps out of RAM 103. [0019] Read only memory ("ROM") 102 is provided to store invariant instruction sequences such as start-up instruction sequences or Basic Input/Output Operating System (BIOS) sequences.

[0020] Input/Output (""I/O") devices 102 A. such as, for example, a keyboard, a pointing device ("mouse'^*), a monitor, a modem and the like, are also provided for receiving input/output instructions. [0021] Host system 100 optionally connects to a computer network (not shown) via network interface 101 A. One such network is the Internet that allows host system 100 to download applications, code, documents and others electronic information. [0022] Host system 100 is coupled to a non-volatile memory device (for example, a flash memory device (or card)) 105 that includes a controller module 106 (may also be referred to as "memory controller" or "controller"), and solid-state memory modules (may also be referred to as cells/cell arrays) 107-108 (shown as Memory Module #1 and Memory Module #n). Controller module 106 interfaces with host system 100 via a bus interface 104, directly via system bus 101 B or any other peripheral bus (not shown). [0023] Non-volatile memory device 105 includes a processor (shown as "crypto- engine") 106 A that performs various cryptographic functions, for example, encrypting and/or decrypting stored content. Crypto-engine 106A may also be used to authenticate a non-volatile memory device, as described below.

[0024] In some embodiments, non-volatile memory devices are flash memory devices. There are currently many different flash memory cards that are commercially ATTORNEY DOCKET NO.: SDK0854.PCT

available, examples being the CompactFlash (CF), the MultiMediaCard (MMC), Secure Digital (SD), miniSD, Memory Stick. SmartMedia and TransFlash cards. Although each of these cards has a unique mechanical and/or electrical interface according to its standardized specifications (for example, the Universal Serial Bus (USB) specification based interface, incorporated herein by reference in its entirety), the flash memory included in each card is very similar. These cards are all available from SanDisk Corporation, assignee of the present application.

[0025] SanDisk Corporation also provides a line of flash drives under its Cruzer trademark, which are hand held memory systems in small packages that have a Universal Serial Bus (USB) plug for connecting with a host by plugging into the host's USB receptacle. Each of these memory cards and flash drives includes controllers that interface with the host and control operation of the flash memory on the card or drive. [0026] Host systems that use such memory cards and flash drives are many and varied. They include personal computers (PCs), laptop and other portable computers, cellular telephones, personal digital assistants (PDAs), digital still cameras, digital movie cameras and portable audio players. Host systems typically include a built-in receptacle for one or more types of memory cards or flash drives but some require adapters into which a memory card is plugged. [0027] A NAND architecture of the memory cell arrays 107- 108 is currently preferred, although other architectures, such as NOR, can also be used instead. Examples of NAND flash memories and their operation as part of a memory system may be had by reference to United States Patents numbers 5,570,315; 5.774.397; 6,046,935; 6,373.746: ATTORNEY DOCKET NO.: SDK0854.PCT

6,456,528; 6,522,580; 6,771,536 and 6,781,877 and United States Patent Application Publication number 2003/0147278.

[0028] The various embodiments described herein are not limited to the foregoing structures. Various other structures and memory types may be used, for example, non- flash memory devices can be used with this disclosure, such as one time programmable memory devices or 3D memory devices, which may include a monolithic three- dimensional memory array. In a three dimensional memory array, multiple memory levels are formed above a single substrate, such as a wafer, with no intervening substrates. The layers forming one memory level are deposited or grown directly over the layers of an existing level or levels. In contrast, stacked memories have been constructed by forming memory levels on separate substrates and adhering the memory levels atop each other, as in Leedy, US Patent No. 5,915.167. "Three dimensional structure memory." The substrates may be thinned or removed from the memory levels before bonding, but as the memory levels are initially formed over separate substrates, such memories are not true monolithic three dimensional memory arrays.

[0029] Figure IB shows a block diagram of the internal architecture of controller module 106. Controller module 106 includes a microcontroller 109 that interfaces with various other components via interface logic 111. Memory 110 stores firmware and/or software instructions that are used by microcontroller 109 to control the operation of non- volatile memory device 105. Memory 110 may be volatile re-programmable random access memory ("RAM"), a non-volatile memory that is not re-programmable ("ROM"), a one-time programmable memory or a re-programmable flash electrically-erasable and programmable read-only memory ("EEPROM^''). ATTORNEY DOCKET NO. : SDK0854.PCT

[0030] A host interface 113 interfaces with host system 100, while a flash interface

112 interfaces with memory modules 107-108.

[0031] Figure 1C shows a block diagram of system IOOA where non-volatile memory device 105 interfaces with host system 100 via a USB interface 10OB, A remote server 114 authenticates non- volatile memory device 105 before a user is allowed to use the non-volatile memory device.

[0032] Accordingly, in one embodiment, non-volatile memory device 105 conforms to the USB specification (i.e. can be accessed via a USB interface). Standard USB based application programming interface (API) may be used for reading or writing data. [0033] Non-volatile memory device 105 appears to host 100 having a plurality of Logical Units (LUNs) of storage space and each LLIN may appear to be of a different class of storage device. For example, non- volatile memory device 105 may appear to have both a standard Mass Storage Class volume (LUN 0. 107A), which imitates the behavior of a SCSI Hard Disk Drive, and a MMC Class volume, which imitates the behavior of a CD-ROM (LUN L 107B).

[0034] LUN 1 107B may store a plurality of software applications (116, Figure ID). a minimal version of an operating system ("Micro-OS") ( 1 15, Figure ID), code for a virtual engine (120, Figure ID), and other information, discussed below with respect to Figure ID. [0035] Hidden area 107C is secured and is not available without proper authentication. Proprietary APIs may be used to access hidden area 107C. In one aspect. a protected (or secured) area means an area that is read-only and accessible only by an appropriate authenticated entity, for example, a host program, and the like. Hidden area ATTORNEY DOCKET NO.: SDK0854.PCT

107C may store device certificates (1 18. Figure ID) and security keys (1 19. Figure ID) and other code, as described below with respect to Figure ID.

[0036] It is noteworthy that although host system 100 has been described above as having a CPU, ROM, RAM and other components, the adaptive aspects of the present disclosure may be implemented on a "thin" client, i.e.. a host system that has limited computing abilities. For example, a USB reader/executor with a keyboard, mouse, video card, network card and CPU can execute whatever code/application is stored on nonvolatile memory device 105, instead of a desktop or notebook computer. [0037] Figure ID shows a plurality of software components that may be stored in non- volatile memory device 105 and used according to one aspect of the present disclosure. Firmware 117 is used to control the overall operation of non- volatile memory device 105 and is executed by controller 106.

[0038] Micro-OS 115 is a minimal version of an operating system, i.e., it has reduced functionality compared to a standard operating system. Micro-OS 115 is used to control the overall environment in which code for a virtual engine is executed. Micro-OS 115 may be customized to run code for the virtual engine, described below. Micro-OS may be stored in the read only segment 107B (Figure 1C).

[0039] Application 1 16 may be a software application that a user may want to execute on different hardware/software platforms. More than one application 1 16 may be stored in non- volatile memory device 105.

[0040] Application 116 may include a web browser, for example. Firefox*. that a user uses to browse websites. The web browser may run on any computer connected to the Internet. The web browser receives and sends requests to a web server and acquires ATTORNEY DOCKET NO.: SDK0854.PCT

information from a World Wide W^reb (WWW), a network of computers. A web server is a program that, upon receipt of a request, sends requested data to a requesting user, [0041] Virtual engine (or machine) (VE) 120 includes code for providing a virtual environment. The virtual environment provides a software platform that is independent of a host operating system. Code that is executed in the virtual environment is not controlled by the host operating system, but instead is controlled by a virtual operating system executed within the virtual environment.

[0042] VE 120 also includes executable code for different operating systems executed in the virtual environment, independent of the underlying host operating system. Micro- OS 115 controls the overall execution of VE 120.

[0043] Code blocks for different operating systems are shown as VOSl, VOS2, VOS3 and VOSn. VOSl may be used to execute a Windows^"8 based operating system, VOS2 may be used for a Linux operating system, VOS2 may be used for a LINIX based operating systems and so forth. The operating system specific code (VOSl-VOSn) is executed in a virtual environment, independent of the host system 100 operating system. VE 120 allows a user to use non-volatile memory device 105 on different hardware/software platforms.

[0044] Different types of virtual engines 120 may be used to implement the adaptive aspects of the present disclosure. For example. VMWare Player and VMWare Ace available from VMware Corporation; VirtualPC available front Microsoft Corporation: and others may be used . It is noteworthy that more than one virtual engine may be stored and used for application execution. This will make it more difficult for pirates to ATTORNEY DOCKET NO.: SDK0854.PCT

break into the operating system because the viruses or other disruptive software will have to hook to low-level support for two or more virtual engines instead of one virtual engine. [0045] The non- volatile memory device 105 during an authentication stage, as described below uses device certificates 118. [0046] Security keys 119 may be used to generate a one-time password to authenticate a user/device. Security keys 119 may be used by crypto-engine 106A to encrypt stored content, using standard or proprietary encryption techniques.

[0047] Virtual private network (VPN) code 121 is provided to facilitate a VPN connection, as described below. Access to VPN code 121 is limited (by storing in LuN 1 (107B), Figure 1C) so that a virtual connection is difficult to pirate or break into.

[0048] It is noteworthy that executable code for a plurality of software components (Micro-OS 115, application 1 16, firmware 117, device certificates 1 18, security keys 119. virtual engine 120 and VPN code 122) may be stored in secured segment 107C or in read only segment 107B. Furthermore, executable code for the plurality of components may be bifurcated and partially stored in the read only segment 107B and secured segment 107C.

[0049] Figure 2 shows a process flow diagram for securing operating system/application execution in one aspect of the present disclosure. The process starts in step S200, when non- volatile memory device 105 is coupled to host system 100 that detects non-volatile memory device 105. Most host systems today have a "Plug-N-Play" option where a device is detected as soon as it is plugged in. Firmware 117 or hardware (not shown) detects the type of operating system that is running on host system 100. ATTORNEY DOCKET NO.: SDKO854. PCT

[0050] After the host operating system is detected, in step S202, non-volatile memory device 105 and a user using the device are authenticated. In one aspect, server 114 authenticates non- volatile memory device 105 using device certificates 1 18. A standard or proprietary technique may be used to authenticate non-volatile memory device 105. For example, a public key infrastructure (PKI) certificate (for example, 118) may be used to authenticate non- volatile memory device 105. A user using non- volatile memory device 105 may also have to authenticate itself before being allowed access to nonvolatile memory device 105. This may be performed by using a unique, user-specific password, generated by using security keys 1 19. Crypto-engine 106 A may be used to authenticate non-volatile memory device 105 and the user. Step S202 attempts to prevent unauthorized use of non- volatile memory device 105.

[0051] In step S204. non-volatile memory device 105 loads code (VOSl, VOS2, VOS3, or VOSn) for a virtual machine into RAM 103. In one aspect of the present disclosure, controller 106 may execute virtual engine code 120 to initialize a virtual environment. In another aspect, virtual engine code 120 execution may be split such that one code segment is executed by the host CPU (101 , Figure IA) and another segment is executed by non- volatile memory device 105. This makes pirating or hacking difficult. [0052] After virtual engine code 120 is initialized, all other applications/code (for example, application 1 16) is executed in a virtual environment independent of the host operating system.

[0053] In step S206. host system 100 opens a virtual private network (VPN) connection (not shown) to an enterprise server or gateway (not shown). The nature of the network connection will depend on the connection, e.g.. whether the connection is to a ATTORNEY DOCKET NO,: SDK0854.PCT

web server or local area network. VPN code 121 may be used to open the VPN connection.

[0054] In step S208, application 116 is executed in the appropriate virtual operating system environment. Application 116 is executed in a virtual environment controlled by virtual engine 120, independent of the host operating system. Hence, it is difficult to break into (hack into) application 116 execution.

[0055] In one aspect of the present disclosure, code for application 116 is written so that it may be executed in a virtual environment, which may be independent of a host system operating system.. Hence, different versions for application 116 for different operating systems and platforms are not needed. This reduces overall cost of code development/m aintenance .

[0056] In another aspect of the present disclosure, because virtual engine 120 and application 116 are stored in a read only segment (for example. 107B (or 107C)) of nonvolatile memory device 105, they are difficult to pirate. [0057] In yet another aspect of the present disclosure, a secure environment is provided to a user to conduct electronic commerce transactions, for example, bank transactions. without changing overall user experience. Once non- volatile memory device 105 is connected and the virtual environment is launched, the user simply navigates to a website with minimal pirating risk. [0058] While the present disclosure is described above with respect to what is currently considered its preferred embodiments, it is to be understood that the disclosure is not limited to that described above. To the contrary, the disclosure is intended to cover ATTORNEY DOCKET NO.: SDK0854.PCT

various modifications and equivalent arrangements within the spirit and scope of the appended claims.

Claims

ATTORNEY DOCKET NO.: SDK0854.PCTWhat is claimed is:

1. A non- volatile memory device comprising: a plurality of memory cells, wherein a read only segment of a plurality of memory cells stores (a) code for a micro-operating system for running a virtual engine; (b) code for the virtual engine that provides a virtual environment, independent of a host operating system; (c) code for a virtual operating system that is executed in the virtual environment; and (d) code for a software application, wherein the code for the software application can be executed in different host system platforms in the virtual environment.

2. The non- volatile memory device of Claim 1. wherein a secure non-volatile memory device segment stores a device certificate used to authenticate the non-volatile memory device.

3. The non- volatile memory device of Claim 2, wherein a remote server authenticates the non- volatile memory device.

4. The non-volatile memory device of Claim 1, wherein the non-volatile memory device detects the host operating system.

5. The non- volatile memory device of Claim 1, wherein the software application is a web-browser. ATTORNEY DOCKET NO.: SDK0854.PCT

6. The non- volatile memory device of Claim 1, wherein the code for the virtual engine, the code for the virtual operating system and the code for the software application are executed by a host system processor after being loaded by the non-volatile memory device to a host system memory.

7. The non- volatile memory device of Claim 1, wherein the code for the virtual engine. the code for the virtual operating system and the code for the software application are executed by a non- volatile memory device controller.

8. The non- volatile memory device of Claim 1, wherein the non- volatile memory device is a universal serial bus (USB) device that interfaces with the host system via a USB interface.

9. The non- volatile memory device of Claim 1. wherein the code for the virtual operating system and the code for the software application are stored in a secured area of the nonvolatile memory device.

10. The non- volatile memory device of Claim 1. wherein the host system opens a virtual network connection based on code stored in the non-volatile memory device.

11. The non- volatile memory device of Claim 1« wherein the code for the software application can be executed in more than one hardware and software environment. ATTORNEY DOCKET NO.: SDK0854.PCT

12. A system for code execution, comprising: a host computing system; and a non-volatile memory device operationally coupled to the host computing system, the non- volatile memory device comprising a plurality of memory cells, wherein a read only segment of a plurality of memory cells stores: (a) code for a micro-operating system for running a virtual engine; (b) code for the virtual engine that provides a virtual environment, independent of a host operating system; (c) code for a virtual operating system that is executed in the virtual environment; and (d) code for a software application, wherein the code for the software application can be executed in different host system platforms in the virtual environment.

13. The system of Claim 12, wherein a secure non- volatile memory device segment stores a device certificate used to authenticate the non-volatile memory device.

14. The system of Claim 13, wherein a remote server authenticates the non- volatile memory device.

15. The system of Claim 12, wherein the non-volatile memory device detects the host operating system.

16. The system of Claim 12, wherein the software application is a web-browser. ATTORNEY DOCKET NO.: SDK0854.PCT

17. The system of Claim 12, wherein the code for the virtual engine, the code for the virtual operating system and the code for the software application are executed by a host system processor after being loaded by the non-volatile memory device to a host system memory.

18. The system of Claim 12. wherein the code for the virtual engine, the code for the virtual operating system and the code for the software application are executed by a nonvolatile memory device controller.

19. The system of Claim 12, wherein the non- volatile memory device is a universal serial bus (USB) device that interfaces with the host system via a USB interface.

20. The system of Claim 12. wherein the code for the virtual operating system and the code for the software application are stored in a secured area of the non- volatile memory device.

21. The system of Claim 12. wherein the host system opens a virtual network connection based on code stored in the non-volatile memory device.

22. The system of Claim 12, wherein the code for the software application can be executed in more than one hardware and software environment.

23. A method for executing a software application, comprising: ATTORNEY DOCKET NO . : SDK0854. PCT

authenticating a non-volatile memory device coupled to a host system; detecting a host operating system, wherein the non-volatile memory device detects the host operating system: executing a virtual operating system in a virtual environment, wherein the virtual operating system is stored in a read only segment of the non-volatile memory device; and executing the software application in the virtual environment, wherein the software application is stored in a read-only segment of the non- volatile memory device: and the virtual operating system and the software application are executed independently of the host operating system execution.

24. The method of Claim 23, wherein the software application is a web-browser,

25. The method of Claim 23, wherein a remote server authenticates the non- volatile memory device using a device certificate stored in a secure area of the non- volatile memory device.

26. The method of Claim 23, wherein the virtual operating system and the software application are executed by a host system processor after the virtual operating system and the software application are loaded by the non-volatile memory device to a host system memory. ATTORNEY DOCKET NO.: SDK0854.PCT

27. The method of Claim 23. wherein the virtual operating system and the software application are executed by a non-volatile memory device controller.

28. The method of Claim 23, wherein the non- volatile memory device is a universal serial bus (USB) device that interfaces with the host system via a USB interface.

29. The method of Claim 23, wherein the virtual operating system and the software application are stored in a secured area of the non-volatile memory device.

30. The method of Claim 23, wherein the host system opens a virtual network connection based on code stored in the non-volatile memory device.

31. The method of Claim 23. wherein the software application can be executed in more than one hardware and software environment.

32. The method of Claim 23. wherein the virtual environment is controlled by a virtual engine; and the virtual engine is stored in a read only segment of the non-volatile memory device.

33. A method for executing a software application, comprising: detecting a host operating system; executing a virtual operating system in a virtual environment, wherein the virtual operating system is stored in a non- volatile memory device; and ATTOENEX DCMKET NO . : SDK0854 . PCT

executing a software application in the virtual environment, wherein the software application is stored in the non-volatile memory device: and the virtual operating system and the software application are executed independently of the host operating system execution.

34. The method of Claim 33, wherein the software application is a web-browser.

35. The method of Claim 33. wherein a remote server authenticates the non- volatile memory device using a device certificate stored in the non-volatile memory device.

36. The method of Claim 33. wherein the virtual operating system and the software application are stored in a read-only segment of the non-volatile memory device; and the virtual operating system and the software application are executed by a host system processor after the virtual operating system and the software application are loaded by the non- volatile memory device to a host system memory.

37. The method of Claim 33, wherein the virtual operating system and the software application are stored in a read-only segment of the non- volatile memory device; and the virtual operating system and the software application are executed by a non-volatile memory device controller.

38. The method of Claim 33, wherein the non-volatile memory device is a universal serial bus (USB) device that interfaces with the host system via a USB interface. ATTORNEY DOCKET NO.: SDK0854.PCT

39. The method of Claim 33, wherein the virtual operating system and the software application are stored in a secured area of the non-volatile memory device.

40. The method of Claim 33, witerein the host system opens a virtual network connection based on code stored in the non-volatile memory device.

41. The method of Claim 33. wherein the software application can be executed in more than one hardware and software environment.

42. The method of Claim 33. wherein the virtual environment is controlled by a virtual engine; and code for the virtual engine is stored in a read only segment of the nonvolatile memory device.

07