Systems and methods for using push notifications for security policy enforcement

A system comprising:

• a memory;
• a network gateway configured to provide network gateway services to a user device wherein network traffic between the user device and the internet passes through the network gateway, key storage storing a server private key, wherein a server key pair comprises a server public key and the server private key;
• push subscription storage storing push subscription data received from the user device, the push subscription data comprising an endpoint URL (uniform resource locator) provided to the user device by a push service in response to a push subscription request comprising the server public key;
• security policy storage storing a plurality of security policies, the network gateway configured to enforce at least one of the plurality of security policies by blocking a communication from the user device to a recipient device, wherein
• the network gateway sends a message to the endpoint URL, the message comprising policy information describing the blocking of the communication and comprising authentication data generated at least in part using the server private key,
• a push server at the endpoint URL pushes a push message to the user device in response to receiving the message, the push message comprising the policy information;
• and
• a web page server configured to serve a captive portal web page to the user device before network gateway service are provided to the user device, the captive portal web page comprising the service public key.

A non-transitory computer readable medium storing computer readable instructions, that when executed on one or more processors, implements a method comprising:

• providing a server public key to a user device, wherein a server key pair comprises the server public key and a server private key;
• receiving push subscription data from the user device, wherein the push subscription data comprises an endpoint URL (uniform resource locator) provided to the user device by a push service in response to a push subscription request comprising the server public key;
• providing network gateway services to the user device;
• enforcing at least one of a plurality of security policies by blocking a communication from the user device to a recipient device;
• sending a message to the endpoint URL, the message comprising policy information describing the blocking of the communication and comprising authentication data generated at least in part using the server private key, wherein a push server at the endpoint URL pushes a push message to the user device in response to receiving the message, the push message comprising the policy information;
• and
• providing a captive portal web page to the user device before providing network gateway service to the user device, the captive portal web page comprising the server public key.