# US 2021/0243017 A1 · Systems and methods for using push notifications for security policy enforcement > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2021/0243017 A1 - Document ID: US20210243017A1 - Status: Published application - Kind: A1 - Application number: 16/779,310 - Filed: 2020-01-31 - Published: 2021-08-05 - Earliest claimed: 2020-01-31 - Assignees: Versa Networks, Inc. - Applicants: Versa Networks, Inc. - Inventors: Sunil RAVI - Web page: https://patentgrep.com/patent/US20210243017A1 ## CPC - H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)} - H04L 9/0825: {using asymmetric-key encryption or public key infrastructure [PKI], e.g. key signature or public key certificates} - H04L 9/088: {Usage controlling of secret information, e.g. techniques for restricting cryptographic keys to pre-authorized uses, different access levels, validity of crypto-period, different key- or password length, or different strong and weak cryptographic algorithms (network architectures or network communication protocols for using time-dependent keys in a packet data network H04L63/068)} - H04L 9/0894: {Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage} - H04L 41/0894: Policy-based network configuration management - H04L 41/0895: Configuration of virtualised networks or elements, e.g. virtualised network function or OpenFlow elements - H04L 41/22: comprising specially adapted graphical user interfaces [GUI] - H04L 63/0876: {based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint} - H04L 67/55: Push-based network services - H04W 12/037: of the control plane, e.g. signalling traffic - H04W 12/0431: Key distribution or pre-distribution; Key agreement - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72) ## Abstract An advancement over previous techniques uses push notifications to inform users of actions by a security appliance or network gateway. The network gateway provides network gateway services to a user device and enforces security policies on the communications to and from the user device. When a security policy blocks a communication, the user may know network traffic is being lost but does not know why. The user device can subscribe to a push server using a public encryption key provided by the security appliance. The security appliance can thereafter send push notifications via the push server to the user. The push notifications can inform the user of security policies being applied to communications to and from the user device. ## Claims ### Claim 1 A method comprising: providing a server public key to a user device, wherein a server key pair comprises the server public key and a server private key; receiving push subscription data from the user device, wherein the push subscription data comprises an endpoint URL (uniform resource locator) provided to the user device by a push service in response to a push subscription request comprising the server public key; providing network gateway services to the user device; enforcing at least one of a plurality of security policies by blocking a communication from the user device to a recipient device; and sending a message to the endpoint URL, the message comprising policy information describing the blocking of the communication and comprising authentication data generated at least in part using the server private key, wherein a push server at the endpoint URL pushes a push message to the user device in response to receiving the message, the push message comprising the policy information. ### Claim 2 (depends on 1) The method of claim 1 further comprising: receiving the push message from the push server; determining that the plurality of security policies approve providing the push message to the user device; and providing the push message to the user device in compliance with the plurality of security policies. ### Claim 3 (depends on 1) The method of claim 1 further comprising: providing a captive portal web page to the user device before providing the network gateway services to the user device, the captive portal web page comprising the server public key. ### Claim 4 (depends on 1) The method of claim 1 comprising: blocking all communications through the network gateway by the user device until after receiving the push subscription data. ### Claim 5 (depends on 1) The method of claim 1 comprising: blocking all communications by the user device, excepting push service communications, through the network gateway until after receiving the push subscription data. ### Claim 6 (depends on 1) The method of claim 1 wherein the endpoint URL is a unique endpoint URL associated with the user device and with the server public key. ### Claim 7 (depends on 1) The method of claim 1 wherein the push subscription data comprises a user private key, and wherein the policy information is encrypted using the user private key. ### Claim 8 (depends on 7) The method of claim 7 further comprising: storing the server private key and the user private key in a secure vault; and obtaining the server private key and the user private key from the secure vault before sending the message. ### Claim 9 (depends on 1) The method of claim 1 further comprising: adding a new security policy to the plurality of security policies after receiving the push subscription data from the user device, the new security policy providing for allowing the push message to be sent to the user device. ### Claim 10 A system comprising: a network gateway configured to provide network gateway services to a user device wherein network traffic between the user device and the internet passes through the network gateway, key storage storing a server private key, wherein a server key pair comprises a server public key and the server private key; push subscription storage storing push subscription data received from the user device, the push subscription data comprising an endpoint URL (uniform resource locator) provided to the user device by a push service in response to a push subscription request comprising the server public key; and security policy storage storing a plurality of security policies, the network gateway configured to enforce at least one of the plurality of security policies by blocking a communication from the user device to a recipient device, wherein the network gateway sends a message to the endpoint URL, the message comprising policy information describing the blocking of the communication and comprising authentication data generated at least in part using the server private key, wherein a push server at the endpoint URL pushes a push message to the user device in response to receiving the message, the push message comprising the policy information. ### Claim 11 (depends on 10) The system of claim 10 wherein the network gateway receives the push message from the push server, wherein the plurality of security policies approve providing the push message to the user device, and wherein the push message is provided to the user device in compliance with the plurality of security policies. ### Claim 12 (depends on 10) The system of claim 10 further comprising: a web page server configured to serve a captive portal web page to the user device before network gateway services are provided to the user device, the captive portal web page comprising the server public key. ### Claim 13 (depends on 10) The system of claim 10 wherein all communications through the network gateway by the user device is blocked until after receiving the push subscription data. ### Claim 14 (depends on 10) The system of claim 10 wherein all communications by the user device, excepting push service communications, through the network gateway are blocked until after receiving the push subscription data. ### Claim 15 A computer readable medium storing computer readable instructions, that when executed on one or more processors, implements a method comprising: providing a server public key to a user device, wherein a server key pair comprises the server public key and a server private key; receiving push subscription data from the user device, wherein the push subscription data comprises an endpoint URL (uniform resource locator) provided to the user device by a push service in response to a push subscription request comprising the server public key; providing network gateway services to the user device; enforcing at least one of a plurality of security policies by blocking a communication from the user device to a recipient device; and sending a message to the endpoint URL, the message comprising policy information describing the blocking of the communication and comprising authentication data generated at least in part using the server private key, wherein a push server at the endpoint URL pushes a push message to the user device in response to receiving the message, the push message comprising the policy information. ### Claim 16 (depends on 15) The computer readable medium storing computer readable instructions of claim 15, the method comprising: receiving the push message from the push server; determining that the plurality of security policies approve providing the push message to the user device; and providing the push message to the user device in compliance with the plurality of security policies. ### Claim 17 (depends on 15) The computer readable medium storing computer readable instructions of claim 15, the method comprising: providing a captive portal web page to the user device before providing network gateway services to the user device, the captive portal web page comprising the server public key. ### Claim 18 (depends on 15) The computer readable medium storing computer readable instructions of claim 15, the method comprising: blocking all communications through the network gateway by the user device until after receiving the push subscription data; and blocking all communications by the user device, excepting push service communications, through the network gateway until after receiving the push subscription data. ### Claim 19 (depends on 15) The computer readable medium storing computer readable instructions of claim 15 wherein the push subscription data comprises a user private key, and wherein the policy information is encrypted using the user private key. ### Claim 20 (depends on 19) The computer readable medium storing computer readable instructions of claim 19, the method comprising: storing the server private key and the user private key in a secure vault; and obtaining the server private key and the user private key from the secure vault before sending the message.