The application of smart medical devices in the Internet of Medical Things (IoMT) has significantly improved the efficiency of health monitoring and disease management, but it has also brought about security challenges related to device authentication and key negotiation. To address security issues in resource-constrained device environments, this paper proposes a three-entity IoMT authentication and key negotiation protocol based on physical unclonable functions (PUFs) and fuzzy extractors. This protocol combines PUFs, fuzzy extractors, and hash techniques to achieve efficient and secure communication. Security analysis shows that the proposed protocol can effectively resist common threats such as replay attacks, man-in-the- middle attacks, desynchronization attacks, and internal attacks. Compared with existing solutions, the proposed protocol ensures high security while having low computational and communication overhead, making it particularly suitable for smart medical device applications with limited computational resources.