Very simplified, it takes your private key and a derivation path and hashes that. The derivation path is just a sequence of numbers, and if you increment one of those numbers, you get a new private key.

The fun bit is you can apply the same derivation path to the public key, and get a new address which belongs to the derived private key.

Therefore if you have the master private key on a separate device, and the master public key somewhere else, they don't need to communicate to get a new address to receive, which you have the private key to spend for offline.

This is very simplified, there's probably a few more steps involved, but this (I think) is the gist of why you don't need internet.