Performance problem is a big challenge for network function virtualization (NFV) based security service function chain (NS-SFC). To solve this problem, a TCP offloading based SFC for virtual network security, called TOChain was proposed, which avoids reduplicative packet processing over TCP/IP stack and virtual network interfaces. And furthermore, a throughput guarantee oriented strongly synchronized periodical CPU scheduling algorithm for TOChain was presented. Finally, the prototype based on KVM and the performance of the prototype with three types of virtualized network function (VNF), including iptables, Snort and FreeWAF was developed and evaluated. It is shown that TOChain achieves a significantly higher performance with a lower CPU utilization compared to the NFV based traditional SFC architecture. With strongly synchronized periodical algorithm, the network performance achieved is very close to the configured throughput under the light and medium traffic load. Moreover, even under the heavy load, it also ensure fairness between virtual machines.