With the rapid development of Internet of Things (IoT), traditional homes are gradually transforming into smart homes. However, the massive number of devices and open channels in IoT make device authentication problematic in terms of inefficiency and privacy leakage. To realize efficient and secure authentication between users and devices, a new anonymous batch authentication protocol is proposed. Balancing security and practicality is difficult for authentication and key agreement (AKA) protocols. Three-factor authentication mechanisms are typically used to provide user login security, and device-side security is protected by physically unclonable functions (PUF). In addition, elliptic curves are used in our protocol to optimize key exchange, which reduces the computational overhead of the device. Combined with the practical needs of users who want to communicate with multiple devices at the same time, a new batch authentication protocol is proposed. In order to prove the security of the proposed protocol, formal security analysis is performed. Finally, our protocol is compared with other protocols in order to show the performance of the protocol. The comparison results of individual authentication and batch authentication show that our protocol is superior to other related protocols.