Abstract: The Internet of Medical Things (IoMT) is reshaping continuous patient monitoring, yet the authentication and key-agreement (AKA) mechanisms protecting medical telemetry remain exposed to two threats that current blockchain-based schemes do not jointly address. Protocols secured with elliptic-curve cryptography offer no protection against a future quantum adversary, exposing lifelong health records to harvest-now-decrypt-later attacks; and schemes claiming device-capture resistance frequently store long-term secrets in device memory, so a captured node still leaks the values needed to forge sessions. This paper presents QP-BAuKAP, a quantum-resistant, physically-unclonable-function (PUF)-anchored three-party AKA scheme for a three-tier IoMT architecture of device, hospital server, and cloud server, built on a permissioned Hyperledger Fabric blockchain. QP-BAuKAP replaces device-stored secrets with a PUF response reconstructed at run time through a fuzzy extractor, derives the session key from a hybrid of an ephemeral ECC contribution and an ML-KEM (Module-LWE) encapsulation so that confidentiality holds as long as either the elliptic-curve or the lattice problem remains hard, and adds an on-chain Merkle revocation registry for dynamic device decommissioning. We prove semantic security in the Real-or-Random model through a sequence of games reduced to the ECDDH assumption, the IND-CCA security of the KEM, and PUF unpredictability. We corroborate this with Scyther and ProVerif under the Dolev-Yao model. A performance study on a Fabric v2.5 network benchmarked with Hyperledger Caliper shows that QP-BAuKAP achieves quantum resistance and genuine device-capture resistance at modest overhead and remains practical for constrained IoMT deployments.

Key words: authentication, blockchain, fuzzy extractor, hyperledger fabric, internet of medical things, key agreement, ML-KEM, physically unclonable function, post-quantum cryptography, provable security