Control vs. Data Plane Architecture: Decoupling Web Dashboard from Client Engine

1. Overview & Decoupling Philosophy #

The BEX platform strictly decouples its Control Plane (Web Dashboard, billing engine, user management, and token accounting) from its Data Plane (client runtime engines, eBPF packet routing, and edge gateway tunnels). This architectural separation ensures that high-volume network packet forwarding operates independently of web infrastructure state. A failure, maintenance window, or traffic spike on the administrative Web Dashboard will never disrupt active VPN tunnels or cause packet degradation across client engines.

2. Functional Separation & Responsibilities #

BEX isolates system capabilities into two distinct operational planes with zero shared execution runtime:

• Control Plane Responsibilities:
  • User authentication, OAuth2 authorization, and role-based privilege management.
  • Reseller balance accounting, credit allocations, and top-up transaction processing.
  • Node discovery, global server load-balancing policies, and client configuration generation.
  • Long-term analytics aggregation and administrative UI rendering via web/REST portals.
• Data Plane Responsibilities:
  • High-speed virtual TUN interface packet capture, encapsulation, and decapsulation.
  • eBPF-driven kernel-level packet filtering, rate limiting, and byte counters.
  • Encrypted transport protocol execution (WireGuard, Xray/VLESS, custom obfuscation).
  • Dynamic local split-tunneling routing evaluations and DNS proxy resolution.

3. Asynchronous State Synchronization & gRPC Stream #

To keep edge gateways and client engines updated with user entitlements without introducing synchronous HTTP request latency into network routing:

• mTLS-Encrypted gRPC Streams: Control plane orchestrators push real-time access policy updates, revoked token lists, and node status changes to data plane nodes via persistent gRPC streams secured with mutual TLS (mTLS).
• Local In-Memory Cache (Redis/eBPF Maps): Edge data plane nodes cache active session keys, user balance limits, and route rules directly in high-speed RAM and eBPF maps.
• Zero-Latency Data Path: Ingress and egress packets are evaluated against local memory caches in microseconds without making blocking network calls back to the central web server or database.

4. Fault Isolation & Autonomous Edge Resilience #

The decoupled architecture guarantees zero-downtime operation and fault isolation under extreme network or infrastructure failures:

• Autonomous Edge Continuity: If the Web Dashboard, central database, or billing API goes offline, existing client sessions remain fully active. Data plane nodes continue routing traffic and metering usage locally.
• Batch Re-Sync on Recovery: When control plane connectivity is restored, edge gateways stream accumulated usage metrics back to the central ledger via batch transactions.
• Blast Radius Containment: A security compromise or DDoS attack against the web dashboard cannot compromise active encryption keys or take down the underlying packet routing mesh.

5. Key Strategic Benefits #

• Uninterrupted User Connectivity: System updates or outages on the web portal cause zero dropped connections for active users.
• Linear Scalability: Control plane and data plane can scale independently based on CPU versus network bandwidth demands.
• Enhanced Security Posture: Administrative web servers hold no direct access or sockets to active client packet streams.