Wireless sensor networks (WSNs) are deployed in hostile environments in many applications. In order to resist security threats, sensor nodes of WSNs often use pre-shared secret keys to encrypt and exchange confidential data. Accordingly, designing key management protocols that can securely distribute secret keys among sensor nodes becomes an important issue for WSNs. This paper proposes a novel key management protocol for hierarchical WSNs based on hypergraph. In the proposed protocol, a WSN is viewed as a hypergraph. That is, a sensor node is represented as a vertex and a cluster is represented as a hyperedge. Compared to previous investigations, the proposed protocol possesses the following features. (1) Scalability. No matter how many sensor nodes and how many clusters are in a WSN, the proposed protocol can use constant communication rounds to establish all cluster keys. Therefore, it is especially suitable for resource-constrained large-scale WSNs. (2) Applicability. In the proposed protocol, all sensor nodes can be deployed randomly and establish cluster keys without knowing the topology of the whole network in advance. (3) Flexibility. This paper also presents dynamic insert and remove protocols. The dynamic insert protocol allows newly deployed sensor nodes to join an existing WSN while the dynamic remove protocol can delete compromised sensor nodes from a WSN. (4) Robustness. The proposed protocol can resist node capture attacks, node cloning attacks, wormhole attacks and energy consumption attacks.