One Control Plane Away: Are Cloud Providers Critical Infrastructure#

Krassimir Tzvetanov – Purdue University

• Why: Quantifies the web's provider concentration properly — separating fronting, hosting, and DNS — with a method operators can reuse on their own dependency chains; resonates with post-Cloudflare-2025 resilience thinking.
• What: A weekly measurement pipeline (since Aug 2026) over the Tranco top 10,000. Naive apex-A-to-ASN attribution undercounts CNAME-deployed CDNs by up to 2.4–2.7× (Akamai) and overcounts clouds by conflating hosting with fronting; the full layered pipeline finds Cloudflare fronts 29.4% of the top-1,000 but 46.3% of the top-10,000 (bigger properties diversify; 13% of strongly-fronted domains are multi-CDN), while the mid-tail single-homes. DNS is separately concentrated (Cloudflare 26.1%, Route 53 21.8%, only 13.7% self-hosted). Combining layers: 21.9% of live top-10k domains depend on Cloudflare for both DNS and delivery — one control-plane event from total unavailability — and 37.9% are double-dependent on some single organization. Tool and dataset to be released at publication.
• How: Layered evidence (strongest wins): CNAME chains for apex and www, provider-published service ranges (e.g. AWS CLOUDFRONT vs EC2 tags), HTTP/TLS fingerprints, BGP origin data, with inter-layer disagreements retained rather than silently resolved.
• Where applicable: The exposure-assessment recipe is general — run it against your own domains and dependency chains; the headline numbers are specific to the Tranco cohort.