In computing, SPICE (the Simple Protocol for Independent Computing Environments) is a remote-display system built for virtual environments that allows users to view a computing "desktop" environment not only on its computer-server machine, but also from anywhere on the Internet using a wide variety of machine architectures.
History
Qumranet originally developed SPICE using a closed-source codebase in 2007. Red Hat, Inc. acquired Qumranet in 2008, and in December 2009 released the code under an open-source license and made the protocol an open standard.
Architecture
SPICE consists of several separate components:
- Server – Captures frames and sends them to clients.
- Clients – Render the captured frames and display them on the local computer.
- Agents – Run in the (possibly virtual) computer and facilitate aspects of remote interaction, such as copy-pasting or file transfers.
A SPICE client connection to a remote desktop server consists of multiple data channels, each running over a separate TCP or UNIX socket connection. Data channels can operate in either clear-text or TLS modes, allowing administrators to trade off security level versus performance.
Security
The SPICE protocol supports ticket-based authentication using a shared secret. The server generates an RSA public/private keypair and sends its public key to the client. The client encrypts the ticket (password) with the public key and sends the result back to the server, which decrypts and verifies the ticket. The current SPICE protocol also supports the SASL authentication protocol, enabling a wide range of admin-configurable authentication mechanisms, including Kerberos.
Implementations
- spice-protocol – Defines the SPICE wire protocol formats, available under the BSD license, portable across Linux and Windows.
- spice – The reference implementation for the server side of the SPICE protocol, provided as a dynamic library. QEMU uses this to provide a SPICE interface for virtual machines. Licensed under LGPL v2+.
- spice-gtk – Implements a SPICE client using the GObject type system and the GTK widget toolkit. Portable across Linux, OS X, and Windows. Licensed under LGPLv2+.
- spice-html5 – Implements a SPICE client using JavaScript intended to run inside an HTML5-capable web browser. It connects to the server indirectly via a WebSocket proxy. Licensed under GPLv3+ and LGPLv3+.
Applications
- QEMU/KVM – QEMU merged support for SPICE remote desktop capabilities in March 2010. The QEMU binary links to the spice-server library and implements the QXL paravirtualized framebuffer device to enable performance benefits.
- Xspice – A wrapper script for the X.Org Server driver for the QXL framebuffer device that makes it possible to launch an Xorg server whose display is exported via SPICE, without requiring QEMU/KVM virtualization.
- virt-viewer – Uses the spice-gtk client library to connect to virtual machines using SPICE.
- oVirt – SPICE is integrated into the oVirt private cloud management software, allowing users to connect to virtual machines through SPICE.
- Proxmox VE – Integrates SPICE for interaction with virtualized desktop devices, including keyboard, mouse, audio, and video.
See also
- Red Hat Virtualization
- HP Remote Graphics Software
External links
- Official website: spice-space.org
