Authentication for network-based virtual machine replication

A system comprising:

• a virtualization host comprising a hardware processor and a hypervisor, the hypervisor comprising a certificate management service, the virtualization host to:
• install a first data change filter in the hypervisor, the first data change filter to intercept first data change operations from a first virtual machine executing on the hypervisor, wherein the first data change filter comprises a first process to execute in the hypervisor, and the certificate management service comprises a second process to execute in the hypervisor;
• provide a private certificate and a public certificate to the first data change filter from the certificate management service by sending the private certificate and the public certificate from the second process to the first process;
• establish an authenticated network connection between the virtualization host and a first replication host using the private certificate and the public certificate;
• and
• send the first data change operations to the first replication host over the authenticated network connection.

A non-transitory machine-readable storage medium comprising instructions that upon execution cause a virtualization host comprising a hardware processor to:

• install a data change filter in a hypervisor of the virtualization host, the hypervisor to execute a virtual machine, wherein the hypervisor comprises a certificate management service to store a private certificate for the data change filter and a public certificate for a replication processing service;
• direct the data change filter to retrieve the private certificate and the public certificate from the certificate management service by establishing an inter-process communication channel between the data change filter and the certificate management service, and transferring the private certificate and the public certificate over the inter-process communication channel;
• intercept, by the data change filter, data change operations from the virtual machine;
• establish an authenticated network connection between the data change filter and the replication processing service using the private certificate and the public certificate;
• and
• send, by the data change filter, the data change operations to the replication processing service over the authenticated network connection.