Patent ID: 8640220

Claim:
A computer-implemented method for processing data packets in an electronic environment, comprising: under control of one or more computer systems configured with executable instructions, receiving a packet to a physical network interface on a host machine executing a guest operating system, the guest operating system having native access to a first physical processing unit of the host machine, the host machine including a second physical processing unit inaccessible by the guest operating system, the host machine further including an input/output (I/O) hub configured to: restrict the first physical processing unit from modifying header information of the packet in the physical network interface and enabling the first physical processing unit to access a payload portion of the packet in the physical network interface; and enable the second physical processing unit to modify the header information of the packet in the physical network interface, the physical network interface capable of transmitting packets of data between a secure environment and a user environment; extracting the header information for the packet using the physical network interface and causing the header information to be forwarded to the second physical processing unit; if the packet is received from the user environment, determining a mapping of a first address of the packet in the user environment to a second address of the packet in the secure environment using the second physical processing unit; updating header information to the packet to specify the second address; and forwarding the packet to the second address using the physical network interface; and if the packet is received from the secure environment, determining a mapping of the second address of the packet in the secure environment to the first address of the packet in the user environment using the second physical processing unit; updating header information to the packet to specify the first address; and forwarding the packet to the first address using the physical network interface, wherein the physical network interface is able to offload at least a portion of processing for the packet to the second physical processing unit.