Web Desktop Interface (WDI)

Transcription

1 Whitepaper Web Desktop Interface (WDI) Jose carlos Norte, CTO, eyeos Ankit Iyer, Product Manager, eyeos July 2012

2 This document is confidential property of eyeos, S.L., and any copying or distribution of all or part of its content by any means without our prior written permission is forbidden. Its use and disclosure is limited to that expressly authorised under the contract or within the project under which it was delivered to you. Unless otherwise indicated, the information in this document is not binding and eyeos, S.L. will not be held liable for any errors or omissions. 2

3 Index Executive summary...4 Types of Desktop Virtualization...5 Understanding Virtualization Architecture...7 User environment management/endpoint management...9 Remoting Protocol...10 Connection Broker...10 Workspace Management...11 Application virtualization: isolation /streaming...11 Hypervisor Management...12 Web Desktop Interface (WDI)...15 Understanding the SPICE Protocol...16 A Brief History of SPICE...16 Traditional VDI...16 The SPICE Protocol...16 The eyeos SPICE Web Client...19 Architecture Diagram...20 Implications of eyeos s Solution...22 A Breakthrough Web Client, Integrated with a VDI solution...22 Flexible Application Delivery Mechanisms...22 Advanced Adaptability to Non-PC Devices...23 Cost Effective Infrastructure...23 Efficient Resource Utilization...23 Advanced Features for Web Delivery...24 Conclusion...26 Glossary of Terms Used...27 References

4 Executive summary Desktop virtualization has become a buzzword in enterprises everywhere. Most enterprises approach the technology as a means to reduce costs and integrate solutions so that a centrally managed environment can be built for IT. There are several vendors in the desktop virtualization industry, and each provides a different set of benefits. The core idea remains the same: decoupling of IT resources to have layers of abstraction within which to control the enterprise. For instance, decoupling of the desktop layer potentially allows the end user to work from anywhere and still be able to access a familiar environment with access to all the applications that reside on that layer. For IT, it means having the ability to manage the entire enterprise desktop as a single layer, without having to manage the underlying architecture, or worry about breaking compatibility with applications that depend on the desktop layer. This document aims to provide an understanding of what desktop virtualization is, and how various desktop virtualization solutions work. It provides a basic understanding of what the underlying components are in a VDI solution and looks at the current technology capability of different vendors in the market. It introduces the term 'Web Desktop Interface' (WDI) and explains how WDI expands the capabilities of a traditional VDI solution to be able to deliver virtualized content through a web browser. It also introduces the reader to the eyeos stack, SPICE web protocol and the eyeos SPICE web client, that is capable of delivering virtualized legacy applications via web protocol to a web browser. 4

5 Types of Desktop Virtualization Desktop virtualization Client-side local execution Server-hosted remote execution Bare-metal Type #1 hypervisor Hosted Type #2 hypervisor Shared Remote Desktops (RDSH) Personal Remote virtual Desktops (VDI) Personal Remote physical desktop (Blade PC) Non- Persistent Layered Persistent Pooled Hybrid Private Fig.1 Desktop Virtualization overview Source: VDI smackdown, PQR, Feb

6 There are two main types of desktop virtualization: client-side and server-hosted. A Server-Hosted Virtual Desktop Infrastructure (SH-VDI) is a remote desktop solution providing remote access to Windows desktops and applications. The virtual machines are running from within the data center. The virtual infrastructure increases the system s independence, availability and manageability. The implementation of Server-Hosted VDIs means that desktops are no longer bound to a location or end-user appliance. Each user has their own, unique, personalized, fully independent work place. Programs run and data is processed and stored on a centralized personal desktop. Information is sent to the client screen via a remote display protocol such as Microsoft RDP, Citrix ICA/ HDX, Teradici/VMware PC-over-IP, SPICE or VNC. The protocol used for displaying the correct information depends on the operating system, bandwidth, the type of application, and other technical facilities. As with other desktop delivery solutions, VDI consist of various infrastructure components that facilitate management, load balancing, session control and secure access to virtual workstations. Microsoft, Citrix, Quest, Oracle, Virtual Bridges, Red Hat and VMware are all important suppliers within the server-hosted VDI segment. The Graphical Processor Unit (GPU) acceleration functionality can be added to a server- hosted VDI solution. It provides each (virtual) machine with enough graphic performance to run multimedia, 2D/3D, Next- Gen and Unified Communications. Display data is presented to the client device via an optimized remote display protocol. To ensure that the end-users experience the best possible performance, the bandwidth, latency, or local (software) components have to meet extra requirements. In the case of eyeos, the entire desktop is web based, and as a result is much lighter than a traditional windows desktop. This makes the delivery of content to the client device very efficient and lightweight. For use cases that need windows applications, virtualized apps are delivered to the web browser. SPICE intelligently adapts to the underlying architecture and leverages client GPU, server GPU and network bandwidth to provide the best solution. In the diagram above, eyeos is a Server 6

7 Understanding Virtualization Architecture hosted, personal, layered VDI solution. The modern end-to-end desktop virtualization solution consists of many components. However, not all of these components or layers are needed to provide a complete solution. In some cases, a single layer, or the combination of a few layers will be able to provide the virtualization capability needed by an organization. Different vendors provide a different set of advantages in the industry today, and to expect each vendor to provide every aspect of virtualization is impractical. For the sake of understanding the various components and capabilities on offer in the world of virtualization today, we will look at what the various layers of desktop virtualization provide. Typically, all of these layers reside at the data center, with a transport protocol used to send data and a client receiver residing on the client side. 7

8 Endpoint / Desktop Receiver Endpoint / Desktop Receiver Endpoint Management Desktop Advertisement Transport Protocol Desktop Orchestation / Desktop Brokering Transport Protocol & Broker Management User Workspace Applications User Workspace Applications Workspace Management Application Virtualization Operating System Operating System Desktop Provisioning Virtual Desktop Virtual Desktop Hypervisor Hardware Hardware Monitoring & Performance Management Storage Virtualization Storage Storage Management Source: 8

9 For the sake of simplicity, we will be focusing on understanding the following layers of the VDI stack: User environment management/ endpoint management. Some kind of way to manage and customize a shared desktop for individual users, above and beyond roaming profiles. A remoting protocol with complete app compatibility. The protocol must support high graphics, multimedia, seamless audio, etc. On a fast network it needs to work as if the users don't even know they're working remotely. Desktop Connection broker. This is the baseline requirement that's needed to connect users into the VDI environment and to broker connections. User Workspace/ Workspace Management: The ability to allow users to have a roaming profile or a persistent profile. All user settings and data must be available the next time the user logs on. ment and end point management tools also include a management interface for IT departments to retain control of the layer as a whole, either at the time of deployment or to manage end user settings and preferences. UEM includes tools like Citrix XenDesktop, and in the case of eyeos, the eyeos desktop. Tools like these allow customization of the user interface, provide tools for maintenance and allow management of the virtual desktop configuration in terms of user permissions and user context for each user or group. eyeos s UEM is powerful because it runs within a web browser, making it truly platform independent and allowing the focus to be on the user experience, independent of the device used. Desktop Virtualization solutions usually have a persistent, non-persistent or layered approach when it comes to managing user environments in VDI solutions. These solutions aim to solve two problems in a single layer: End user preferences or settings customizability and group policy/ access rights control for IT. Application isolation / streaming: The ability to run applications in a VM without first going through the Windows (or host OS) installation process. Hypervisor management. The ability to turn on, suspend, migrate and provision VMs. User environment management/endpoint management User Environment Management (UEM) and endpoint management tools are interfaces that allow the end user to access files, data and settings. These include virtual desktops or interfaces that allow the entire user experience to be controlled locally while being executed remotely. The focus is primarily on the end-user and his environment and not on the end user's device. Usually, User Environment Manage- Non- Persistent Pooled Layered Hybrid Persistent Private 9

10 Non-Persistent: Non Persistent desktops are the simplest to manage. IT has only a single gold image or master image on which to apply patches, and the end user is always presented with the same, clean desktop. A gold image or master image provides the advantage of having a single operating system deployed for all users. It has the disadvantage of not being customizable and of not storing user settings or changes to the interface. This has the potential of reducing the end user experience, potentially lowering productivity in some cases. Persistent: Persistent desktops contain user customization information as well as settings. Each time a user logs on, he is being presented with his own, customized desktop. Applications, settings and preferences are on a per user basis, and are unique for each user. The user can apply settings or changes, log off and his customizations will be retained the next time he logs on. Depending on how this is implemented, managing persistent desktops can be challenging for IT to manage. Because of the one-to-one mapping of user settings to desktop environments, applying patches or updates can be challenging and complex. Layered: A layered approach combines the advantages of a persistent desktop with the advantages of a non-persistent desktop while including very few drawbacks. With this implementation, each user also needs a fraction of the space needed to run a conventional OS: ideally, each user needs only swap space and a space that contains all the changes from the original OS (the space for all the deltas ). This simplifies the management of the OS as well, as the support team only needs to manage the single gold image instead of each user s OS individually. Using a master image allows multiple identical virtual machines to be created and if additional machines are required which are set up differently, then multiple tailored master images can be created for the provisioning server to use. eyeos uses a single master image that is deployed for all users, allowing all updates and maintenance tasks to be applied to that central image. eyeos even goes one step further, allowing user profile and environment information to be stored separately, giving the system a stateful feature set (user customization and settings), while maintaining the benefits of a stateless system (central management of updates, easy single image deployment) as well. This layering combines the benefits of stateful and stateless desktops in one solution. Remoting Protocol Several remoting protocols exist, each promoted by a different vendor, and in each case offering slightly different advantages. Protocols like ICA (used by Citrix), PCoIP (PC-over-IP, used by VMware) and SPICE (Used by eyeos and Virtual Bridges in their VERDE5 solution) are not cross compatible, resulting in the choice of remoting protocol being a very important decision for a vendor, because the protocol determines the overall performance of the end user experience. Things like the flexibility of the content delivered, bandwidth based optimization, high definition graphics and smoothness of experience are all determined by the remoting protocol used. For instance, PCoIP offers an innovative host rendering, Multi-codec decode and Dynamic bandwidth adapting system. ICA transmits high-level window display information, and also features adaptive bandwidth usage technology. SPICE (explained in detail in section 4.3) uses an innovative three-component model that allows direct-to-gpu information streaming so that the client device can reduce the server GPU workload, while also featuring adaptive bandwidth usage technology. Connection Broker In desktop virtualization, a connection broker is a software program that allows the end-user to connect 10

11 to an available desktop. The connection broker is responsible for facilitating user access to the virtual machines on a remote system via integration with existing authentication services. The connection broker can also monitor the connection between users and the remote virtual machines and be configured to select particular remote virtual machines or make a selection from a 'pool' of similar virtual machines. The connection broker maintains a list of available virtual desktops, and when a client device makes a request it provides the client with the connection information for the most appropriate virtual desktop, or a response that indicates that an appropriate virtual desktop is not currently available. In many cases there are more than one appropriate virtual desktop, in which case the connection broker will have the option to provide the client with a list of possible candidates. The client will generally display this list to the user so that she or he can make a selection. The connection information provided by the connection broker to the client must contain the address of the virtual desktop, but may contain additional configuration information, such as which communication protocol to use and settings for that protocol. Workspace Management Note: Some desktop virtualization solutions may also call this user profile management or roaming profile management. Different vendors treat the term workspace management slightly differently. In the context of the eyeos architecture, this section contains some overlap with the User Environment Management section described above. While the section on UEM is more of an end-user perspective, the workspace management layer provides a description of the tools that IT has available to have granular control over the end user environment. While we have described this in the workspace management section, it is important to note that this can be considered to be a single UEM layer within the eyeos architecture. A workspace management solution aims to provide the user with a virtual workspace : A single layer of abstraction that contains all the users files, settings and preferences that can be accessed in the layers above, regardless of device used. For IT, this layer provides a means of controlling user groups, user profiles, application level access control, user level or group level storage limits, etc. Within eyeos, the admin panel allows for creation of user groups and profiles that can be managed centrally by IT. Everything from storage space to application access control can be defined on a user group level from within the admin panel. This also means that the end user has access to a familiar, customized desktop interface, independent of the device from which the desktop is being accessed. Since the entire OS is provided through a web browser, the end user also has the capability to have access to a virtual workspace: an environment that provides all of the applications, files and tools that the user requires, delivered through a web browser. Application virtualization: isolation / streaming Application virtualization allows organizations to deliver applications to end user client devices when they are needed. This solves a lot of problems like managing installations, updates and application compatibility, as the applications are sandboxed and execute in their own virtual space within the server. The delivery process of transporting the application specific data/resources to the end-point at the time the application is executed is called streaming. The application is quick-up-and-running and only the minimum amount of data (commonly between 10-30% of the total application) is delivered to a client before the application is launched. Not only does this result in a quicker first time launch for the user, it also results in significantly reduced load on the network (compared with full application distribution pre-caching) and makes it possible to keep end-user 11

12 images stateless. Citrix XenApp enables application virtualization by having an agent installed in the client. This is an agent like Citrix Receiver that can connect to a virtual application session and display it on the client device. Ericom does single app delivery, without requiring any installation on the client side. In the latest version of Ericom s AccessNow, virtualizing any application through a web browser running HTML5 is possible, without needing any complex client management software, thereby making the application delivery purely server based. eyeos is a very powerful browser based application delivery platform that also performs functions like application virtualization without the need to install any client software, since the entire OS runs through the web browser. Furthermore, with eyeos s SPICE web client, applications can be virtualized and streamed right to the browser of the client device, just like Ericom s Access Now. eyeos s agentless architecture means that no client side installation is required, any user can just connect and use the operating system, and any device with a web browser is sufficient to run the OS. The advantage of eyeos s solution is that the user experience is controlled and delivered through a single platform: the web browser. While Ericom s solution is a single purpose technology, eyeos provides a platform for all the needs of the user: The end user has access to a workspace and application delivery platform as well as an interface to deliver virtualized applications, without every leaving the eyeos desktop. Hypervisor Management A hypervisor, also called Virtual Machine Manager (VMM), is one of many hardware virtualization techniques allowing multiple operating systems, termed guests, to run concurrently on a host computer (or a single physical server). The main function of the hypervisor is to provide isolated environments for each Virtual Machine (VM) and to manage access between the guest operating systems and the underlying hardware resources on the physical server. The hypervisor presents to the guest operating systems a virtual operating platform and manages the execution of the guest operating systems. Hypervisor management tools facilitate tasks like live migration of VM s, a key feature in the virtualization market. In case a VM reaches full capacity in terms of RAM or CPU usage etc, a hypervisor management tool must be able to migrate the user s client session to another physical server without the end users experience being affected. Hypervisor management would usually also include functionality like starting and suspending VM s. KVM provides all of these advantages within the eyeos architecture. Linux virtualization users have two free, open source hypervisors to choose from: Xen and KVM. In the Openstack architecture, KVM is the default hypervisor. The biggest advantage of having a KVM hypervisor is that it is open source. VMware's ESX Server is the most popular hypervisor, while Microsoft's Hyper-V is number two and Citrix' XenServer is number three. KVM is behind the top three and ahead of Oracle's Oracle VM in terms of popularity. eyeos uses the KVM hypervisor and the Openstack architecture, making the overall solution inexpensive, when compared to existing solutions in the market. It is important to note that while the KVM hypervisor is open source, its capabilities are as good as, if not better than other solutions in the market, as detailed in the Openstack hypervisor comparison matrix detailed below. 12

13 Feature XenServer/XCP KVM QEMU LXC ESX ESXi Launch Reboot Terminate Resize Rescue Pause Un-pause Suspend Resume Inject Networking * * * * Inject File * * Serial Console VNC Console * * * Attach Volume Detach Volume Live Migration Snapshot iscsi Set Admin Pass Get Guest Info 13

14 Get Host Info Glance Integration Service Control VLAN Networking Flat Networking Security Groups Firewall Rules Routing Nova diagnostic Source: Legend: indicates support, indicates the feature is not supported, * indicates there is a caveat to the functionality and a blank cell generally indicates more testing is needed to make a judgment. 14

15 Web Desktop Interface (WDI) WDI is a term that is used to describe the next generation of VDI solutions: Those that have similar underlying architecture to conventional VDI solutions, but are capable of delivering content through a web protocol and displaying it on the client device's web browser. WDI makes the layer responsible for delivery of content completely Independent of the underlying client architecture, as long as the client device's browser is capable of rendering HTML5 content. This opens the door to a host of possibilities, and allows for truly agentless access to enterprise networks. It also creates a device agnostic and OS agnostic environment because a web browser is the only thing the client device needs, and whether the OS is Windows, OSX, Android or ios becomes Irrelevant. There exists a clear dichotomy when it comes to enterprise IT spending: most of the productivity comes from the use of applications while most of the expense is in maintaining, upgrading, patching and troubleshooting compatibility on the OS level. A lot of enterprises solve this problem by separating the OS and application layers or by sandboxing user applications and enterprise applications separately so that they do not cause compatibility problems with each other, or with the OS. WDI aims to solve this problem by a bold approach: web technology has reached a state of maturity where an entire operating system can be moved to the web. This has the potential to replace the concept of a local operating system and allows for very thin client devices to perform advanced tasks. For enterprises, this means central management and control over corporate data and access, while still keeping costs down and allowing users to bring their own device to the workplace. It even allows enterprises to focus on building or integrating applications that increase productivity rather than spend on maintaining operating systems, performing patches and upgrades. In the next section, we take a look at how eyeos Implements the WDI concept using the SPICE protocol, to get a better understanding of how this technology works. 15

16 Understanding the SPICE Protocol A Brief History of SPICE Qumranet originally developed SPICE as a closed source codebase in Even though Red Hat acquired Qumranet in 2008, a decision was taken by Red Hat to offer SPICE as open source and in December 2009, Red Hat decided to open-source the protocol and code. This was a vital decision, as it potentially created an opportunity for several vendors to use the SPICE protocol and build clients for the protocol and enrich its ecosystem. In effect, Red Hat opened the doors to the possibility of having a platform on which several vendors and technologies could be interconnected. Traditional VDI Traditional VDI protocols usually consist of two components: A server side component (Back-end) and a client side receiver (Front-end) that decodes the signals sent by the server: *Figure 2 A traditional VDI or virtualization solution has data broken down into signals for mouse, keyboard, audio and video commands. Most of the bandwidth is taken up by video commands and this causes a bottleneck in a smooth user experience. The SPICE Protocol SPICE is a remoting protocol that stands for: Simple Protocol for Independent Computing Environments. SPICE brings about innovative changes to the way remoting protocols work, and offers a very powerful way of dealing with the problem of transmitting graphically heavy information across the network with little or no lag for the end user. SPICE is an alternative to Microsoft's Remote Desktop Protocol (RDP) and other remote display protocols, such as Citrix's Independent Computing Architecture (ICA). Benefits of SPICE include enhanced multimedia capabilities and dynamic load balancing between servers and (display) clients. Brian Stevens, CTO and vice president, Engineering at Red Hat said "The SPICE protocol is designed to optimize performance by automatically adapting to the graphics and communications environment that it is running in, so vendors have a terrific opportunity to enhance it for their specific applications". Front-End VDI VDI VDI VDI VDI Virtual Dispaly port Virtual keyboard Virtual Mouse Virtual Sound Device Back-End *Figure 2 Source: Spice-space.org 16

17 Hypervisor Feature Matrix with Openstack: SPICE achieves a user experience similar to an interaction with a local machine, while trying to offload most of the intensive CPU and GPU tasks to the client. SPICE is actually fairly advanced when it comes to bandwidth. It will make determinations of client capabilities, network characteristics, and other parameters to automatically change its behaviour to provide the best user experience possible. (So in some cases it might be sending raw graphics commands to the be processed on the client side, and in other cases it might send what amounts to screen bitmaps to the client). SPICE supports bi-directional audio and video, full USB support and offloading of multimedia processing, raising the VM per host density. SPICE agent is a software module executed in the guest. SPICE server and client use the agent for tasks that need to be performed in the guest context, such as configuring the guest display settings. Since SPICE runs outside the VM, the client device can watch machines boot and control them more directly without waiting for Remote Desktop Services to start. SPICE and the Openstack architecture allows a virtual GPU to run within the VDI back end. This means that instead of graphics commands being run purely on the server, the server can send raw graphics instructions to the client GPU, where the client will decode them. This has powerful implications, because the VM is no longer sending bitmap or raster like images to the client, but is sending graphics instructions to the client GPU for the client to draw. This distribution of load means that the whole user experience is much faster, and more bandwidth can be used more efficiently because heavy bitmaps are no longer being sent across. In fact, SPICE has an innovative solution for video: it separates (or demux s) video commands and sends them to the client GPU, separates audio commands and sends it to the audio card on the client, both with timecodes or timestamps. On the client side, it stitches them together (or MUX s them back together) producing a seamless experience on the client side. The experience can be such that it appears that the video is being run on the client locally. One important thing to understand is that SPICE is architected a bit different than ICA and RDP. While ICA and RDP are made of up two components (a remote software component that runs in the OS of the Windows host, and a client), SPICE is actually made up of three components: Remote guest component: A virtual graphics adapter running in the VM, just like ICA/RDP. Client component; The SPICE client software, just like ICA/RDP. Remote host component: A virtual graphics device, which the hypervisor makes available to the VM. (This is different from today's ICA/RDP.) In other words, because SPICE has a hypervisor component, it will only work when the remote hosts are VMs. The real opportunity and proper packaging of remote display protocols is integrated with the hypervisor, just like VirtualBox does with RDP and Red Hat does with Spice. Doing so provides four main advantages: Guest OS independence, since no guest OS software is required. Much closer to normal desktop experience, since clients can watch the machine boot. Eliminates the complex feature matrix in current protocol/guest OS/client device implementations. High performance. Once of the reasons Red Hat claims to get the spice performance that they get 17

18 is because they can dedicate cycles to protocol remoting outside of the guest VMs, where resources can be more appropriately allocated. (There is a lot of future potential for this to leverage GPUs, PC-over-IP chips, Calista chips, etc.) It s important to first keep in mind that as of today, even though SPICE can only connect to remote hosts running on KVM-based hypervisors there is an increase in adoption of the SPICE-KVM model and a lot of companies are leveraging the benefits of this technology, including Red Hat and Virtual Bridges. The cost advantage of leveraging the combination of these two open source technologies is immense, and since they are open source, an ecosystem of independent vendors developing add-ons to these technologies is increasing. Openstack has also provided a very capable solution in the latest release codenamed Essex and will be bringing on a host of powerful features in the upcoming Folsom release. In the current market, there are very few vendors who are in a position to leverage the advantages of the SPICE and Openstack combination. Citrix doesn't need to, they provide HDX/ICA with all their products, and so they have no incentive to support another protocol. Microsoft already has something like this with Remote FX as part of Hyper-V. That just leaves VMware, but now that they have invested in PCoIP, they may not have an incentive to add another protocol, especially if it means making changes to the hypervisor. This provides a massive advantage to eyeos, because it is one of the few companies leveraging the advantages of SPICE with an Openstack solution, eventually being able to package a complete virtualization technology at a fraction of the cost of other competitors. 18

19 The eyeos SPICE Web Client Fig: Virtualized windows 7 being delivered through the web browser eyeos has developed a technology that is one of the first of its kind: A web based client built for a remoting protocol as powerful as SPICE. While other virtualization solutions require a client side installation to send an image to the client, eyeos needs only a simple web browser to be able to virtualize. This is because all virtualized images, whether OS or application, are delivered to the web browser of the client. for Google s Chrome OS, the eyeos web client is far more capable by virtue of SPICE s underlying architecture. The ability of the protocol to understand raw graphics commands means that graphics intensive applications can be delivered remotely, and all rendered within a web browser, more efficiently than other protocols. Applications like Photoshop execute with almost no perceptible delay, and behave as though they are being executed on the client s local device. While this is similar to what Citrix Receiver provides 19

20 Architecture Diagram KVM Ubuntu SPICE Gateway Websocket Proxy Websocket Web Browser KVM Windows 7 SPICE Gateway Websocket Proxy Websocket Web Browser Agentless Client Devices Physical VM Host Server Websocket Server Client running Native SPICE client Software Supported browsers:ie 10,Firefox 12,Chrome 19,Safari 6 20

21 The eyeos implementation of SPICE consists of a physical VM host server where Virtual Machines are hosted in KVM s. These KVM s can host virtual instances of windows or Linux operating systems. While the OS runs remotely, data is encapsulated and sent by the SPICE gateway in the form of raw I/O and graphics commands. The data is sent directly from the SPICE gateway to the client device in case the client is using a native SPICE client. This is a software component that runs locally on the client machine and unpacks the data that is being streamed from the SPICE gateway. In case the client device is agentless, and is using a web browser to display the virtual machine screen, a websocket server is required. eyeos has developed a websocket proxy that is capable of encapsulating the raw graphics, audio and I/O commands that can be understood by an HTML5 capable web browser. This information is sent through the websocket server and delivered directly to the client s web browser via the SPICE protocol. All of this takes place very efficiently, so the client sees no perceivable difference in the user experience whether the content is being delivered to the web browser or to the native SPICE client. The capability of the eyeos solution as a whole is evident from the simple yet versatile agentless architecture that a web browser delivery model such 21

22 Implications of eyeos s Solution as this provides. A Breakthrough Web Client, Integrated with a VDI solution With the introduction of a SPICE client, eyeos becomes one of the few companies in the world to have its own remoting protocol client. With its web desktop and virtualization solution combined, it is the only company in the world capable of delivering a virtualization product and an enterprise desktop as a single solution via a web browser. Since eyeos s web desktop implementation is also a stateful desktop, user settings and preferences are maintained across different user sessions, and even after logoff. eyeos s hybrid virtualization is also well placed to deliver this technology. Flexible Application Delivery Mechanisms A single application can be delivered in three diffe- rent ways, based on what solution best fits the usage scenario: The application can be executed locally with eyerun, the application can be replaced with a corresponding web application or web interface, and the application can even be virtualized and delivered remotely to the users web browser. The two latter options use purely a web based architecture to deliver the application to the end user, making eyeos s solution completely device and OS independent, even allowing remote access to a user workspace environment from anywhere. Furthermore, the user session is maintained consistently so an end user could start editing a word document from the local app on his workstation and resume editing where he left off on his ipad on his way home using a virtualized word application delivered to his browser. For a quick read and review, the user could then pull out his phone and use the web application to render a viewable version of the document, without needing to access a virtual or local app. Fig: Virtualized applications can be displayed on any device with a web browser 22

23 Advanced Adaptability to Non-PC Devices Several enterprises in the world today have a mix of web based and windows based applications. A current solution in the enterprise today has been to convert legacy applications to web applications so that there is a consistent application delivery platform: the web browser. However, with the BYOD trend, smartphones and tablets have been added to the mix, and enterprises are expected to support all of these endpoints, while keeping costs down. A large number of legacy applications still exist, for which there are no web version. Not only does eyeos s technology provide a single platform to deliver both web and windows based apps, the technology also solves the endpoint management problem. Instead of having custom solutions for each endpoint device, the SPICE web client can be used with a virtual mouse displayed on touchscreen devices. This virtual mouse has left-click and right-click capabilities and the native device keyboard can be used for text input. This technology enables the client device like a tablet or a smartphone to create a fully capable desktop computing experience. Enterprises will no longer have to rely on re-writing applications to have a web version available, and will no longer have the extra overhead of creating new applications specific to a particular endpoint device. Regular windows based applications, legacy client-server applications and web based applications can all be delivered through the web browser and accessed through any device, even touch screen tablets and smartphones, with minimum loss in the user experience and with full application functionality. Cost Effective Infrastructure All of this is built on a very cost effective infrastructure. SPICE is an open source remoting protocol that is highly capable. Openstack is also an open source solution, meaning that the entire underlying architecture of a hypervisor, a powerful VMM and a remoting protocol has no licensing fee. Open stack has many advocates in the industry and iopen stack has many advocates in the industry and its wide adoption is an indication of the capability of the platform. Openstack has created a booming ecosystem with a lot of development for its platform, and has been implemented by Rackspace, Citrix, Dell, AMD, Intel, Cisco, NTT, NEC, AT&T, Red Hat and Yahoo among others. Justin Santa Barbara from Fathom DB said Openstack will seed many clouds public and private powered by this single, open industry standard. When the capability of the Openstack VMM is taken into consideration, from being dynamically able to assign KVMs and resources to user sessions as they are needed, to being able to have live migration that is imperceptible to the end user, you have a solution that provides extremely powerful benefits, free of cost. Efficient Resource Utilization As mentioned before, SPICE provides a unique benefit by being able to intelligently assess the underlying architecture, and analyse the capabilities of the client machine. This allows the Virtual GPU on the host to offload rendering to the client GPU, in effect sending it low-level GPU commands so that the GPU intensive tasks can be handled on the client side. This provides a number of benefits: 1. Throughput: Any application that is being streamed from the host machine to the client is sending I/O commands and GPU commands. This is allowing the client machine to use its processing capability to provide the user with a real-time interaction with the application as if the client was running on the local client machine itself. This is because the GPU level commands allow 23

24 for a much faster visual feedback: rather than drawing the entire application on the server and then streaming it to the client, the client draws the application locally, giving the user much faster response times, while the server is streaming GPU instructions to the client, at a much faster rate than streaming the content of the whole screen. 2. Reduction in server resource utilization: Another major benefit of this technology is that the server can host more virtual machines and more clients. This is because, once graphic intensive GPU tasks are handed over to the client, the server resource utilization is much less, allowing it to take on a heavier load, potentially allowing more clients to connect to the server simultaneously. This also reduces infrastructure costs in the long run. Advanced Features for Web Delivery With eyeos s SPICE client technology, any content can be delivered through the web browser. 1. For applications running on a desktop, SPICE can transmit the entire desktop, and thereafter only send updates on areas of the screen that are changing (in this case, the application, or even a small part of the application). SPICE can even send just application window content, so that only the application window data is sent across to the client device rather than the full windows desktop. SPICE server identifies the part of the screen that is changing, compresses that information and sends it to the client device (or sends raw GPU commands). This saves on bandwidth and provides high performance, as the network traffic between client and server is only the bits of information where the screen has changed rather than the entire screen. 2. For Images, Spice offers several image compression algorithms, which can be chosen on server initiation, and dynamically at run-time. SPICE s own proprietary compression technology Global LZ (or GLZ) takes advantage of repeating patterns among images for shrinking traffic and saving bandwidth, which is critical in a WAN. Spice also offers an automatic mode for compression selection per-image, where the choice between LZ/GLZ and Quic (another SPICE proprietary compression algorithm) is heuristically based on the image properties. 3. For Audio, Spice supports audio playback and recording, and uses an innovative technique to deliver video content with audio. Playback is compressed using the CELT [5] algorithm. Lip-sync between video and audio is achieved by time-stamping the video frames in the QXL device and injecting them in the client side, synchronized with the audio. Even though video and audio is split up during compression on the server side, the audio and video are stitched back together with the help of timecodes on the client side, giving a near-perfect playback experience. 4. For video, SPICE server heuristically identifies video areas by recognizing regions that are updated at a high rate. These areas are analyzed, isolated and streamed separately. The updates are sent to the client as video streams coded using the Motion JPEG algorithm (M-JPEG). This mechanism saves a lot of traffic; improving Spice performance, especially in WAN. A big advantage is that Video streaming can be chosen on server initiation and can be changed dynamically at run-time. SPICE s video compression algorithm will attempt to provide the best quality possible based on the bandwidth available and organizations can even tweak the performance/ bandwidth utilization to whatever parameters they deem suitable. 5. For Caching, SPICE uses an intelligent mecha- 24

25 nism. Spice implements client image caching in order to avoid redundant transmissions to the client. Caching applies to any kind of image data sent to the client, including bitmaps, palettes and cursors. The cache is defined per connection and synchronized between the server and the client, i.e., in each moment the server knows exactly which images are in the client cache. Moreover, the server is the one to decide whether an item should be added or removed from the cache. The client cache size is set by the client and transferred to the server through the display channel initialization message. The server monitors the current cache capacity and when it lacks space it removes the least recently used cache items until there is enough available cache space, ensuring that the performance is optimal. Essentially, SPICE makes it possible to deliver rich enterprise content while maintaining total control over resource and bandwidth utilization. SPICE has the latest technological enhancements on its side, and uses an intelligent heuristic approach to identify what parts of the screen are changing. eyeos is the first and only company to take advantage of this technology, and make advanced content delivery possible 25

26 Conclusion through a web browser. A Disruptive Technology Not Just for VDI, But for the Future of the Web The flexibility of the entire eyeos solution is extremely powerful considering that a single architecture is capable of fulfilling a diverse set of needs, not just in terms of end user requirements but also by providing a centralized infrastructure for IT to manage. The potential for this technology is enormous: the web has now become a ubiquitous platform for all content delivery, and a protocol like SPICE with the eyeos web client has the potential to deliver any content via the web browser. Furthermore, the SPICE web client has powerful implications when it comes to being used with web apps. With this technology, embedding a fully functional excel worksheet in a web page or web app becomes possible. We are witnessing an era when the concept of local computing is being challenged and where the need for centralization, collaboration and crowdsourcing are driving technology. Different technologies provide different pieces of the solution, but at the same time there is a gradual but undeniable migration towards web technologies. Web based content delivery is reaching a state of maturity, and the modern browser has finally become that single layer that can cater to the needs of a diverse and complex user base, providing universal access to content without sacrificing the quality of the experience. 26

27 Glossary of Terms Used CMDB: Configuration Management Database GPU: Graphics Processing Unit HDX: High Definition User Experience ICA: Independent Computing Architecture KVM: Kernel based Virtual Machine MAM: Mobile Application Management MDM: Mobile Device Management RDP: Remote Desktop Protocol RHEV: Red Hat Enterprise Virtualization RHEL: Red Hat Enterprise Linux SAN: Storage Area Network SBC: Server Based Computing SPICE: Simple Protocol for Independent Computing Environments VDI: Virtual Desktop Infrastructure VMM: Virtual Machine Manager WDI: Web Desktop Interface 27

28 References for_vdi.pdf Bridges Here_2700_s-my-take_3A00_.aspx Bridges A Demo of SPICE:

29 A protocol like SPICE uses a 3 tier architecture: VMware-or-Microsoft.htm %2Fdownload.microsoft.com%2Fdownload%2F7%2F9%2FA%2F79AAA903-25B4-4D BC47D %2FMicrosoft%2520VDI%2520TCO%2520whitepaper%2520customer%2520ready%2520v1%25202.pd f&ei=cs7qt7uvlueu0qxd8bi2bq&usg=afqjcngckoowwv574dp3co0_mkhoomporg&sig2=u2ye_ nxe6nprg5ewthsjfq