• usage control
• android
• mobile devices
• xacml
• code inlining

In this work we propose a novel approach for implementing a fine-grained access control on Android in order to overcome the main flaws of Android's permission system: the adoption of a coarse-grained access control and a huge rely on user participation for decision making.
A code-inlining approach is adopted to capture security relevant operations and usage control, an Attribute Based Access Control (ABAC) mechanism in its dynamic version, is implemented for validating access requests. Requests are compared against policies written in XACML language, an OASIS standard that allows to formulate any possible policy that can be made in natural language.
Design choices with related trade-offs as well as a set of example policies are presented in order to showcase the range of possibilities that is available on UCON on Android for developers.
Finally, some experiments are carried out in order to assess timing overhead due to the introduction of UCON on Android for performing standard access control and usage control requests.