Simple Protocol for Independent Computing Environments
| Company type | Software protocol |
|---|---|
| Industry | Computing, Virtualization, Remote desktop |
| Founded | 2007 |
| Founder | Qumranet |
| Fate | Acquired by Red Hat, Inc in 2008; Open sourced in 2009 |
| Products | Remote display technology for virtual environments |
| Owner | Red Hat, Inc |
In the realm of computing, SPICE—short for Simple Protocol for Independent Computing Environments—is a remote display technology crafted specifically for virtual environments. It allows users to remotely access a computing "desktop" environment across diverse hardware platforms via the Internet.
Originally created by Qumranet in 2007 as proprietary software, SPICE was acquired by Red Hat, Inc in 2008. Subsequently, in December 2009, Red Hat released the source code to the public, transforming SPICE into an open standard aimed at encouraging wider adoption within virtualization and remote desktop sectors.
Security
A connection between a SPICE client and its remote desktop server is composed of several distinct data channels, each operating over individual TCP or UNIX socket connections. These channels can function either without encryption or secured via TLS, giving system administrators flexibility to optimize between security and efficiency. When TLS is enabled, all data transmitted through the channel is strongly encrypted.
SPICE accommodates multiple authentication methods. Its initial approach involved ticket-based authentication using a shared secret: the server generated an RSA keypair and transmitted the public key to the client, which then encrypted an authentication ticket and sent it back for validation. The current protocol version also incorporates SASL, providing administrators with a broader range of configurable authentication mechanisms, including support for Kerberos.
Implementations
While there is only one official server implementation, several client-side SPICE implementations have emerged since the protocol was made open source.
- spice-protocol
- This module specifies the SPICE wire protocol formats. Distributed under the BSD license, it is compatible with both Linux and Windows operating systems.
- spice
- Serving as the reference server implementation, this module is provided as a dynamic library that any application can utilize to offer a SPICE server. As of 2013, it has been integrated into QEMU to provide SPICE support for its virtual machine interface. The code is licensed under LGPL version 2 or later.
- Note that the spicec client component was deprecated and removed in December 2014.
- spice-gtk
- Implemented using the GObject system alongside the GTK toolkit, this module delivers a SPICE client comprising spice-client-glib (handling low-level protocol operations) and high-level graphical widgets for user interaction. Licensed under LGPLv2+, it supports Linux, OS X, and Windows platforms.
- spice-html5
- This module provides a JavaScript-based SPICE client designed to run within browsers that support HTML5. It connects indirectly to SPICE servers through a WebSocket proxy. Licensing is under GPLv3+ and LGPLv3+.
Applications
The inception of the SPICE protocol aimed to improve remote desktop capabilities within a fork of the KVM virtualization codebase.
- QEMU/KVM
- In March 2010, maintainers of QEMU incorporated SPICE remote desktop support across all QEMU virtual machines. The QEMU executable links against the spice-server library and integrates the QXL paravirtualized framebuffer device, enabling guest operating systems to benefit from enhanced performance provided by SPICE. Guests may alternatively use a conventional VGA card, though this results in lower performance compared to QXL.
- Xspice
- The driver for the QXL framebuffer device within the X.Org Server includes a wrapper script that allows exporting an Xorg display session over SPICE. This functionality enables remote desktop access via SPICE without requiring virtualization through QEMU/KVM.
- virt-viewer
- The
virt-viewertool utilizes the spice-gtk client library to connect to virtual machines using SPICE, replacing its prior reliance on VNC. - oVirt
- Within the private cloud management platform oVirt, SPICE is integrated to facilitate user connections to virtual machines through this protocol.