diff --git a/xy_sh/internal/middleware/middleware.go b/xy_sh/internal/middleware/middleware.go
new file mode 100644
index 0000000..6678e7e
--- /dev/null
+++ b/xy_sh/internal/middleware/middleware.go
@@ -0,0 +1,54 @@
+package middleware
+
+import (
+	"log"
+
+	"github.com/gofiber/fiber/v2"
+
+	"xy_sh/pkg/crypto"
+)
+
+// SM3Salt 全局SM3盐值（由config初始化时注入）
+var SM3Salt []byte
+
+// SM4Key 全局SM4密钥（由config初始化时注入）
+var SM4Key []byte
+
+// AuthMiddleware 签名验证中间件
+// 验证请求头中的 timestamp 和 sign
+func AuthMiddleware() fiber.Handler {
+	return func(c *fiber.Ctx) error {
+		timestamp := c.Get("timestamp")
+		sign := c.Get("sign")
+
+		if timestamp == "" || sign == "" {
+			return c.Status(fiber.StatusUnauthorized).JSON(fiber.Map{
+				"code": -1,
+				"msg":  "缺少timestamp或sign请求头",
+			})
+		}
+
+		// 读取请求体中的 encryptedData
+		var body struct {
+			EncryptedData string `json:"encryptedData"`
+		}
+		if err := c.BodyParser(&body); err != nil {
+			return c.Status(fiber.StatusBadRequest).JSON(fiber.Map{
+				"code": -1,
+				"msg":  "请求体解析失败",
+			})
+		}
+
+		// 验证签名
+		if !crypto.VerifySign(timestamp, body.EncryptedData, sign, SM3Salt) {
+			log.Printf("[中间件] 签名验证失败: timestamp=%s, sign=%s", timestamp, sign)
+			return c.Status(fiber.StatusUnauthorized).JSON(fiber.Map{
+				"code": -1,
+				"msg":  "签名验证失败",
+			})
+		}
+
+		log.Printf("[中间件] 签名验证通过: timestamp=%s", timestamp)
+		return c.Next()
+	}
+}
\ No newline at end of file