  We present a comprehensive analysis on connectivity and resilience of secure
sensor networks under the widely studied q-composite key predistribution
scheme. For network connectivity which ensures that any two sensors can find a
path in between for secure communication, we derive the conditions to guarantee
connectivity in consideration of (i) node-capture attacks, where the adversary
may capture a set of sensors and compromise keys in their memory; (ii) sensor
mobility, meaning that sensors can move around so that the network topology may
change over time; (iii) physical transmission constraints, under which two
sensors have to be within each other's transmission range for communication;
(iv) the boundary effect of network fields; and (v) link unreliability, meaning
that links are allowed to be unreliable. In contrast, many prior connectivity
analyses of secure sensor networks often ignore the above issues. For
resilience, although limited studies have presented formal analysis, it is
often assumed that the adversary captures a random set of sensors, whereas this
paper allows the adversary to capture an arbitrary set of sensors. We present
conditions to ensure unassailability and unsplittability in secure sensor
networks under the q-composite scheme. Unassailability ensures that an
adversary capturing any set consisting of a negligible fraction of sensors can
compromise only a negligible fraction of communication links although the
adversary may compromise communications between noncaptured nodes which happen
to use keys that are shared by captured nodes. Unsplittability means that when
a negligible fraction of sensors are captured, almost all of the remaining
nodes are still securely connected. Based on the results of connectivity,
unassailability and unsplittability, we provide useful guidelines for the
design of secure sensor networks.
