Patent ID: 8006297

Claim:
A network interface card (NIC), comprising: a security association database (SADB) comprising a plurality of security associations (SAs) configured to decrypt received packets and encrypt sent packets; a cryptographic offload engine operatively connected to the SADB, configured to: receive an encrypted packet from the network, wherein the encrypted packet comprises a first source address and a destination address, decrypt the encrypted packet using one of the plurality of SAs to obtain a decrypted packet, and send the decrypted packet to a policy engine; a security policy database (SPD), operatively connected to the policy engine, comprising a plurality of security policies (SPs) configured to define access to packet destinations on a host and a plurality of firewall policies configured to determine access to the host, wherein the host is operatively connected to the NIC; and a policy engine configured to: receive the encrypted packet from the cryptographic offload engine, determine a packet destination on the host using the destination address and one of the plurality of SPs from the SPD, determine admittance of the decrypted packet to the host using one of the plurality of firewall policies, modify the first source address to a second source address using the firewall policies to obtain a modified decrypted packet, and send the modified decrypted packet to the destination address in the host.