Abstract: Internet of Things consists of sensor subnet and transmission network．For sensor subnet,it usually collects information by sensor node which has bad ability of computing,communication and storage implemented by combining mobile nodes and static nodes．But for transmission network,it commonly provides strong service of computing,communication and storage by making use of the existing internet infrastructure．To assure security control mechanics when the mobile sensors move from one cluster to another,whenever,to take into account both the security and feasibility of practical application,this paper presented an authentication and key exchange protocol based on Physical Unclonable Function(PUF).This protocol can achieve bidirectional authentication and key negotiation between mobile sensor and transmission network base station when the mobile sensor roams to other cluster ．Analysis shows that the proposed protocol is universally composable secure.

Key words: Internet of things,Physical unclonable function(PUF),Physical unclonable function system(PUFS),Universal composition security