Secure and efficient offloading of network policies to network interface cards

A network interface controller adapted for use as part of a computing device operating a virtualized computing environment comprising a parent partition and at least one virtual machine, the network interface controller comprising:

• a processor;
• and
• at least one computer storage medium containing instructions that, upon execution by the processor, cause the network interface controller to:
• receive from the at least one virtual machine a packet and encrypted address information;
• decrypt the encrypted address information using a first key, wherein the first key is part of a key pair with a second key accessible by the parent partition;
• encapsulate the packet by inserting the decrypted address information into a header of the packet;
• and
• send the encapsulated packet to an external network.

A method of operating a computing device to implement a virtualized computing environment comprising a parent partition and at least one virtual machine, the method comprising:

• the virtual machine requesting address information from the parent partition;
• the parent partition encrypting the requested address information;
• the parent partition sending the encrypted address information to the virtual machine;
• and
• the virtual machine sending a packet with the encrypted address information to a network interface controller of the computing device.

A method of operating a computing device to implement a virtualized computing environment comprising a parent partition and at least one virtual machine, the method comprising:

• the virtual machine determining mapping information that satisfies a criteria relating to a number of connections established by the network interface controller, wherein the connections are associated with the mapping information;
• the virtual machine requesting the parent partition to send to a network interface controller the mapping information that satisfies the criteria;
• and
• the parent partition sending the requested mapping information to the network interface controller.

A method of operating a computing device to implement a virtualized computing environment comprising a parent partition and at least one virtual machine, the method comprising:

• the virtual machine determining mapping information that satisfies a criteria;
• the virtual machine requesting the parent partition to send to a network interface controller the mapping information that satisfies the criteria;
• the parent partition sending the requested mapping information to the network interface controller;
• and
• polling, at predetermined times, the network interface controller to identify the most active connections.