## 2 Research Selection Method  
The selection process was divided into three steps: the first step was identifying the different search terms related to security in RPL. In the second step, for each database, we identified the advanced search system and entered the combination of the selected keywords. Then, once the papers were selected in the second step, a new filter was applied after reading their titles and abstracts. In this SLR, the following search terms were used: RPL Secure, RPL Based Secure, Authentication Protocol and Security Routing Based RPL. Terms were selected after a brief study of the keywords used in the papers related to the line of research addressed in this SLR. As a first step, the most relevant keywords that could yield the desired search results were identified, that is, proposals for secure protocols based on RPL that would mitigate the attacks that are detailed in Table 1. Subsequently, the keywords that threw up a large number of papers and made it impossible to analyze each of them. Finally, the keywords removed in the previous step were combined to refine the search results. The terms finally selected were those that yielded quantitatively valid results for the analysis of this review. The databases explored were IEEE, Science Direct, and Springer. These databases were selected because they host proposals for conferences and journals related to the area of computer science and electrical and electronic engineering. Results about the number of papers selected to the second and third steps are presented in Table 2.  
The proposals selected for the analysis totaled 53. Review papers, or proposals implemented using a routing protocol other than RPL, were discarded (only proposals that concretely ensured the protocol's security were taken into account). Among the proposals reviewed in this section, we found different mechanisms that improve the security of the RPL protocol, and these proposals will be discussed below. Table 3 presents the coding for journals and conferences where papers were published, and Table 4 shows the type of paper coding. These codes are established in order to make reference to conferences, journals, and types of paper during the development of the manuscript in a simpler way. \begin{table}
\begin{tabular}{l c c c c c c} \hline \hline \multirow{2}{*}{**Query/Database**} & \multicolumn{2}{c}{**IEEE**} & \multicolumn{2}{c}{**Science Direct**} & \multicolumn{2}{c}{**Springer**} \\ \cline{2-7}  & **Step 2** & **Step 3** & **Step 2** & **Step 3** & **Step 2** & **Step 3** \\ \hline (((((``\)All Metadata”: security) AND \(``\)All Metadata”: routing) AND \(``\)All Metadata”: rrib) NOT \(``\)All Metadata”: review) & 131 & 43 & – & – & – & – \\ Title, abstract, keywords: RPL based secure and RPL secure & – & – & 147 & 4 & – & – \\ and authentication protocol and Security Routing Based RPL & \multicolumn{2}{c}{} & & & & \\ \(`\)rpl AND based AND secure AND and AND rpl AND secure AND & \multicolumn{2}{c}{} & & & & \\ and AND authentication AND protocol AND and AND Security & – & – & – & 181 & 6 \\ AND Routing AND Based AND RPL & \multicolumn{2}{c}{} & & & & \\ \hline \hline \end{tabular}
\end{table} 
Table 2: Results by databases. The theme and approach coding is described in Table 5. Due to their operation, some attacks shown in Table 1 are related to each other. Therefore it has been decided to unite these attacks and analyze them as a group within this manuscript. Both the RA (rank attack) and the SIA (sinkhole attack) aim to attract network traffic to a specific node, so these two attacks make up an analysis group. SFA (selective forwarding) and BA (blackhole attack) work in the same way with the difference that all received packets are discarded in the BA attack, and in the SFA attack, the malicious node decides which packets to forward and which not. Finally, the DAA and DIA attacks have been united into a single group since they are related to modifying protocol control messages.