Industrial compliance verification method, system and equipment and storage medium

Abstract

The invention relates to an industry compliance verification method, system and device and a storage medium, and belongs to the technical field of computers. The method comprises the following steps: establishing a virtualization platform on a backup server, dynamically creating an isolation network according to a verification task, and recovering a virtual machine to simulate a production environment; communication between the isolation network and the production network is controlled using the proxy gateway. The system comprises a virtualization platform setting module, a recovery module, a task isolation network creation module, an intermediate communication control setting module, a synchronous setting module and a verification execution module. According to the multi-network simulation isolation mode, a safe and isolated verification environment can be provided, and it is ensured that the recovered virtual machine is accurately verified in the state that the recovered virtual machine is isolated from the production network.

Description

Technical Field

[0001] The present invention belongs to the field of computer technology and relates to an industry compliance verification method, system, device and storage medium. Background Art

[0002] The industry compliance report is a vital document for manufacturing companies. It not only proves that the company strictly abides by the "Industry Production Quality Management Standards" during the production process to ensure the quality and safety of the products, but also demonstrates the transparency and reliability of the company's production process. The compliance report demonstrates the company's professional production level and enhances the market's trust in the product.

[0003] With the development of data technology, some companies have begun to produce in isolated environments, such as development and testing. However, in terms of data verification, there is currently no existing technology that can fully consider the isolation, security and convenience of data. In particular, when the virtual machines that need to be verified are often contained in different networks, the creation process of the isolated environment is cumbersome, and the actual situation of the production environment cannot be fully simulated in the verification environment, which affects the accuracy and reliability of the verification results.

[0004] Therefore, how to quickly and easily establish an isolated verification environment under multiple networks, ensure that the isolated verification environment can fully simulate the production environment, and ensure that the verification results are accurate and reliable, is a technical problem that urgently needs to be solved. Summary of the invention

[0005] In order to solve the technical problems in the above-mentioned background technology, the present invention provides an industry compliance verification method, system, device and storage medium.

[0006] The technical solution of the present invention to solve the above technical problems is as follows: In a first aspect, a method for verifying industry compliance is provided, the method comprising the steps of: Create an embedded virtualization platform on the target backup server; At the time point of the verification task, the target recovery virtual machine is restored on the embedded virtualization platform; Dynamically generate multiple task isolation networks based on the IP addresses of the virtual machines in the verification task, and configure each target recovery virtual machine to communicate with its corresponding task isolation network; Create a virtual proxy gateway and a fixed intermediate isolation network. The virtual proxy gateway communicates with the intermediate isolation network and communicates with each task isolation network respectively. The communication between each task isolation network and the production network is controlled through the virtual proxy gateway. Setting up a target recovery virtual machine with all communication connections to fully simulate the operating environment and dynamic operations of the production machine to obtain a virtual verification machine; In an isolated environment, verification is performed by a virtual verification machine.

[0007] In a second aspect, an industry compliance verification system is provided, the system comprising: A virtualization platform setting module is used to create an embedded virtualization platform on the target backup server; A recovery module, used to restore the target recovery virtual machine on the embedded virtualization platform at the time point of the verification task; A task isolation network creation module is used to dynamically generate multiple task isolation networks according to the IP addresses of the virtual machines in the verification task, and configure each target recovery virtual machine to communicate with its corresponding task isolation network; An intermediate communication control setting module is used to create a virtual proxy gateway and a fixed intermediate isolation network. The virtual proxy gateway communicates with the intermediate isolation network and communicates with each task isolation network respectively. The communication between each task isolation network and the production network is controlled through the virtual proxy gateway. A synchronization setting module is used to set up a target recovery virtual machine that is fully equipped with communication connections to fully simulate the operating environment and dynamic operation of the production machine to obtain a virtual verification machine; The verification execution module is used to perform verification through a virtual verification machine in an isolated environment.

[0008] According to a third aspect, an electronic device is provided, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the steps of the above-mentioned industry compliance verification method when executing the program.

[0009] In a fourth aspect, a computer-readable storage medium is provided, on which a computer program is stored, and when the program is executed by a processor, the industry compliance verification method as described above is implemented.

[0010] The beneficial effects of the present invention are: The present invention provides a highly isolated and customizable network environment by creating a virtual proxy gateway and configuring it to connect to a fixed intermediate isolation network and multiple isolation networks dynamically generated according to the IP addresses of the virtual machines in the data verification task. This multi-network simulation isolation method ensures that during the verification process, the restored virtual machine can be carried out in an environment that is completely isolated from the production network, thereby ensuring the security and accuracy of the verification operation. BRIEF DESCRIPTION OF THE DRAWINGS

[0011] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0012] Figure 1 A flowchart of an industry compliance verification method provided in an embodiment of the present invention.

[0013] Figure 2 A schematic diagram of the structure of an industry compliance verification system provided in an embodiment of the present invention.

[0014] Figure 3 A schematic diagram of the structure of a task isolation network creation module provided in an embodiment of the present invention.

[0015] Figure 4 A schematic diagram of the structure of an intermediate communication control setting module provided in an embodiment of the present invention.

[0016] Figure 5 A schematic diagram of the structure of an electronic device provided by an embodiment of the present invention.

[0017] In the accompanying drawings, the components represented by the reference numerals are listed as follows: 2001, virtualization platform setting module; 2002, recovery module; 2003, task isolation network creation module; 2004, intermediate communication control setting module; 2005, synchronization setting module; 2006, verification execution module; 20031, multi-task isolation network generation unit; 20032, first communication configuration unit; 20041, intermediate isolation network creation unit; 20042, virtual proxy gateway creation unit; 20043, second communication configuration unit; 20044, third communication configuration unit; 20045, proxy gateway network information modification unit; 310, processor; 320, communication interface; 330, memory; 340, communication bus. DETAILED DESCRIPTION

[0018] In order to make the purpose, technical solution and advantages of the present invention more clearly understood, the present invention is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not intended to limit the present invention.

[0019] In the Good Manufacturing Practice (GMP), there are extremely high requirements for data integrity, consistency and security. Since data in the production environment is often distributed across multiple networks and servers, it is necessary to simulate the actual situation of multi-network distribution when performing data verification in an isolated environment. Traditional single-network isolation environments cannot meet this requirement because they cannot fully replicate the complex network structure and data flow in the production environment. In addition, the production data of manufacturing companies usually contains sensitive information, such as patient data and production formulas for pharmaceutical manufacturers; production process parameters, raw material data, and production plans for chemical manufacturers. These data require special protection during the verification process to prevent any potential data leakage or unauthorized access. Therefore, a verification environment that can support multi-network isolation is required to ensure that the virtual machines involved in the verification can be safely and accurately recovered and verified no matter which network they are located. This environment must be able to simulate the real production network structure, including different subnets, gateways, and routing configurations, so that the integrity of the data and the effectiveness of the recovery strategy can be fully tested during the verification process, so as to meet the strict compliance standards of the GMP industry.

[0020] In view of the above problems, an embodiment of the present invention provides an industry compliance verification method. Figure 1 A flowchart of an industry compliance verification method provided by an embodiment of the present invention is shown in FIG. Figure 1 As shown, the method includes: Step S101: creating an embedded virtualization platform on a target backup server.

[0021] It can be understood that an embedded virtualization platform refers to a virtualization environment built inside a physical server, which allows multiple virtual machines to run on the same physical server, and each virtual machine can run its own operating system and applications like an independent server. The core components usually include a host machine and a virtual machine monitor running on it.

[0022] Virtualization platforms enable more efficient use of physical server resources (such as CPU, memory, and storage). By running multiple virtual machines on a single physical server, duplicate hardware investment and energy consumption can be reduced.

[0023] Establishing a virtualization platform in the backup server can create a flexible and controllable environment for subsequent data verification tasks.

[0024] Step S102, at the verification task time point, restoring the target recovery virtual machine on the embedded virtualization platform.

[0025] It is worth noting that the target recovery virtual machine is restored from previously backed up data, which can be a full backup containing the operating system, applications, and data, an incremental backup containing only the changed parts, or a snapshot at a specific point in time. The recovery process involves selecting appropriate backup data, extracting it from the backup storage, and using this data to create a new virtual machine instance on an isolated virtualization platform. This process ensures that the virtual machine is started and running in an isolated network, simulating the production environment while maintaining a security boundary.

[0026] Restoring virtual machines from backup data can effectively assist compliance audits. This approach not only ensures that the integrity and accuracy of backup data can be verified in a secure environment, but also allows auditors and IT experts to perform detailed inspections and tests on backup data by simulating a real production environment. This verification process includes consistency checks on files, database records, system configurations, and application status to ensure that business continuity and data protection goals can be met in disaster recovery situations. In addition, virtual machines restored in this way can be used for compliance proofs to demonstrate the effectiveness of an organization's data management and protection measures, thereby helping the organization meet industry standards and regulatory requirements, such as GMP. Therefore, this process can strengthen data security and also increase an organization's confidence in internal and external audits.

[0027] Step S103, dynamically generate multiple task isolation networks according to the IP addresses of the virtual machines in the verification task, and configure each target recovery virtual machine to communicate with its corresponding task isolation network.

[0028] Step S104, creating a virtual proxy gateway and a fixed intermediate isolation network. The virtual proxy gateway communicates with the intermediate isolation network and communicates with each task isolation network respectively. The communication between each task isolation network and the production network is controlled by the virtual proxy gateway.

[0029] It is worth noting that the virtual proxy gateway is a virtual machine. The virtual proxy gateway is a key intermediary node in a dynamic isolated network environment. It is responsible for achieving secure and controllable data transmission between the isolated network and the production network, and providing precise network routing and policy implementation for the recovery virtual machines involved in the verification. Specifically, the proxy gateway can ensure that data transmission between the isolated network and the production network is secure and prevent sensitive information leakage. By avoiding direct connections, the proxy gateway reduces the risk of network attacks and provides traffic control and monitoring capabilities, thereby providing network administrators with a means of auditing and compliance tracking. In addition, the proxy gateway performs network address translation (NAT), allowing virtual machines using private IP addresses to communicate securely with external networks, while simplifying network management and alleviating the need for individual virtual machine configuration by centrally managing network policies and routing.

[0030] It is also worth noting that the intermediate isolation network, as a fixed network environment, provides a management interface for the proxy gateway, enabling it to communicate securely with the production network and each task isolation network without affecting the stability of the production environment. This network environment is not affected by changes in the dynamic task network, ensuring the continuous operation of the proxy gateway, thereby supporting data verification and recovery testing. For GMP compliance requirements, the intermediate isolation network records all network activities through the proxy gateway, ensuring compliance of operations, and also providing a safe and controllable test platform for the recovery virtual machine to be verified.

[0031] Step S105, setting up a target recovery virtual machine equipped with all communication connections to fully simulate the operating environment and dynamic operation of the production machine to obtain a virtual verification machine.

[0032] Step S106: Perform verification in the isolated environment through the virtual verification machine.

[0033] After the virtual verification machine is set up, data verification can be performed, including checking data integrity, file consistency, file comparison, screenshot comparison, network results, heartbeat results, boot results, and virus detection, etc. This example does not make specific restrictions on this.

[0034] This embodiment provides a highly isolated and customizable network environment by creating a virtual proxy gateway and configuring it to connect to a fixed intermediate isolation network and multiple isolation networks dynamically generated according to the IP addresses of the virtual machines in the data verification task. This multi-network simulation isolation method ensures that during the verification process, the restored virtual machine can be carried out in an environment that is completely isolated from the production network, thereby ensuring the security and accuracy of the verification operation.

[0035] Based on the above embodiment, in the method, step S103 includes: Step S1031, when the data verification task contains IP addresses of virtual machines from different network segments, multiple task isolation networks are dynamically generated, and a unique network segment is set for each task isolation network; Step S1032: configuring a first communication connection for each target recovery virtual machine to connect to the corresponding task isolation network. Configuring the first communication connection is to add a virtual network card to the recovery virtual machine.

[0036] By dynamically generating multiple task isolation networks based on the IP addresses of the virtual machines in the verification task and ensuring that each target recovery virtual machine communicates with its corresponding task isolation network, a verification platform that accurately simulates the production environment can be provided. The recovered virtual machines run in an isolated network that matches the original production network structure, thus ensuring the accuracy and integrity of the data verification process. In addition, the dynamic generation method improves the flexibility and adaptability of the verification environment, enabling it to quickly adjust the network configuration according to the specific needs of the verification task, ensuring that the verification process is both efficient and effective.

[0037] To further understand the generation process, here is an example: In the data verification task, if two virtual machines are involved, and their original IP addresses are located in the networks of 192.168.2.1 / 24 and 192.168.3.1 / 24 respectively, the system will dynamically create two corresponding isolated networks based on these addresses, namely 88.88.2.1 / 24 and 88.88.3.1 / 24. This design ensures that the network configuration of the verification environment can accurately map the production environment, thereby providing each virtual machine with a network environment that is isolated from the production network but has a similar configuration. On the virtualization platform, the proxy gateway will be configured to connect to the two isolated networks. By assigning it two network cards and configuring them with IP addresses 88.88.2.5 and 88.88.3.5 respectively, the proxy gateway can manage and forward data traffic between the two isolated networks.

[0038] It is also understood that in the field of IT and network security, those skilled in the art are familiar with the importance of configuring unique network segments to avoid IP address conflicts and ensure network security. This operation is a standard practice for network planning and isolated environment settings. Typically, unique network segments can be generated by automated tools based on preset rules, or manually specified by network administrators based on network architecture and security requirements to ensure that each isolated network has an independent address space. Therefore, this operation is not overly limited in the above embodiments.

[0039] It is worth noting that the IP address range of the dynamically generated isolated network must be different from the address range of the original production network to avoid IP conflicts. At the same time, the target recovery virtual machine uses its original IP address, without the need to reconfigure applications or services, ensuring that the virtual machine can seamlessly continue its network communication in the new environment while maintaining network configuration consistency with the original environment.

[0040] This embodiment enhances the security of the verification environment. By limiting each restored virtual machine to its corresponding isolated network, potential security risks can be minimized to prevent data leakage or interference with the production environment that may occur during the verification process.

[0041] Based on the above embodiment, in the method, step S104 includes: Step S1041, creating a fixed intermediate isolation network and setting a unique network segment for the intermediate isolation network; Step S1042, creating a virtual proxy gateway with a layer 3 forwarding function; Step S1043, configuring a second communication connection for the virtual proxy gateway to connect to the intermediate isolation network, the second configured communication connection is to add a virtual network card and a unique IP address to the virtual proxy gateway; Step S1044, configuring a third communication connection for the virtual proxy gateway to connect to each task isolation network, the third configured communication connection is to add multiple virtual network cards and multiple unique IP addresses to the virtual proxy gateway; Step S1045, modifying the network information of the virtual proxy gateway through the floppy disk file.

[0042] It is important to understand that this example uses Layer 3 forwarding to implement packet routing between different isolated networks at the network layer, ensuring that data can be correctly transmitted in a complex multi-network environment. Layer 3 forwarding allows the proxy gateway to forward and filter traffic based on IP addresses, thereby providing a flexible communication path between different network segments.

[0043] In addition, add a virtual network card and a unique IP address for the virtual proxy gateway. Specifically, it can be a network card from isolated_network, and assign an IP address to the network card, such as 10.192.100.1.

[0044] It is worth noting that for the gateway communication configuration, adding additional virtual network cards and assigning new IP addresses is to enable the gateway to forward data in multiple isolated networks. Each network card corresponds to a different isolated network, and the IP address on each network card is used for communication within that specific network. Doing so ensures that the gateway can correctly route traffic between different isolated networks and the production network while maintaining isolation and security between networks.

[0045] It is also worth noting that, in addition to the floppy disk file, it is also possible to support direct configuration of the network information of the virtual machine through a network management interface or management software, such as using an API call or a command line tool. In addition, configuration management tools such as Puppet, Chef, or Ansible can also be used to automate the deployment and update of network configurations. This example does not specifically limit this.

[0046] Based on the above embodiment, in the method, step S106 includes: Step S1061, collecting a first screenshot of the verification target material on the production machine according to the user instruction, the first screenshot being generated by the backup system client installed on the production machine; Step S1062, collecting a second screenshot of the verification target material on the virtual verification machine; Step S1063, performing comparative analysis on the first screenshot and the second screenshot on the virtual verification machine to obtain a screenshot comparison verification result.

[0047] Different from the above-mentioned embodiment, this example specifically provides a verification method of screenshot comparison, which can provide evidence for the verification result and record it in the report, so that readers can directly view the comparison information.

[0048] Based on the above embodiment, in the method, step S106 further includes: Step S1064, obtaining the specified original file / folder from the secure backup in the production environment according to the user instruction; Step S1065, calculating MD5 or hash values ​​for the original files / folders in the production environment and the restored files / folders in the isolation environment respectively; Step S1066, comparing and analyzing the calculated value of the original file / folder in the production environment with the calculated value of the file / folder restored in the isolation environment to obtain a file consistency verification result.

[0049] Different from the above embodiment, when configuring industry compliance verification, the user selects the files / folders to be compared. During the verification, the system will find the original files / folders, calculate the MD5 and other mark information, and compare it with the mark information of the corresponding files / folders in the restored machine, and store the comparison results in the verification report.

[0050] like Figure 2 As shown, this embodiment provides an industry compliance verification system, which includes: A virtualization platform setting module 2001 is used to create an embedded virtualization platform on a target backup server; The recovery module 2002 is used to recover the target recovery virtual machine on the embedded virtualization platform at the time point of the verification task; The task isolation network creation module 2003 is used to dynamically generate multiple task isolation networks according to the IP addresses of the virtual machines in the verification task, and configure each target recovery virtual machine to communicate with its corresponding task isolation network; The intermediate communication control setting module 2004 is used to create a virtual proxy gateway and a fixed intermediate isolation network. The virtual proxy gateway communicates with the intermediate isolation network and communicates with each task isolation network respectively. The communication between each task isolation network and the production network is controlled through the virtual proxy gateway. Synchronous setting module 2005, used to set up the target recovery virtual machine with all communication connections to fully simulate the operating environment and dynamic operation of the production machine to obtain a virtual verification machine; The verification execution module 2006 is used to execute verification in an isolated environment through a virtual verification machine.

[0051] Among them, Figure 3 As shown, the task isolation network creation module 2003 includes: A multi-task isolation network generation unit 20031 is used to dynamically generate multiple task isolation networks when the data verification task contains IP addresses of virtual machines from different network segments, and set a unique network segment for each task isolation network; The first communication configuration unit 20032 is used to configure a first communication connection for each target recovery virtual machine to connect to the corresponding task isolation network. Configuring the first communication connection is to add a virtual network to the recovery virtual machine.

[0052] Among them, Figure 4 As shown, the intermediate communication control setting module 2004 includes: The intermediate isolation network creation unit 20041 is used to create a fixed intermediate isolation network and set a unique network segment for the intermediate isolation network; A virtual proxy gateway creation unit 20042 is used to create a virtual proxy gateway with a layer 3 forwarding function; The second communication configuration unit 20043 is used to configure a second communication connection for the virtual proxy gateway to connect to the intermediate isolation network; The third communication configuration unit 20044 is used to configure a third communication connection for the virtual proxy gateway to connect to each task isolation network; The proxy gateway network information modification unit 20045 is used to modify the network information of the virtual proxy gateway through the floppy disk file; Among them, the second configuration communication connection and the third configuration communication connection are both to add a virtual network card and a unique IP address to the virtual proxy gateway.

[0053] exist Figure 5 A schematic diagram of the structure of an electronic device provided by an embodiment of the present invention, such as Figure 5As shown, the electronic device may include: a processor 310, a communication interface 320, a memory 330 and a communication bus 340, wherein the processor 310, the communication interface 320 and the memory 330 complete mutual communication through the communication bus 340. The processor 310 may call the logic instructions in the memory 330 to execute the following method: create an embedded virtualization platform on the target backup server; restore the target recovery virtual machine on the embedded virtualization platform at the time point of the verification task; dynamically generate multiple task isolation networks according to the IP address of the virtual machine in the verification task, and configure each target recovery virtual machine to communicate with its corresponding task isolation network; create a virtual proxy gateway and a fixed intermediate isolation network, the virtual proxy gateway communicates with the intermediate isolation network, and communicates with each task isolation network respectively, and controls the communication between each task isolation network and the production network through the virtual proxy gateway; set all target recovery virtual machines equipped with communication connections to fully simulate the operating environment and dynamic operation of the production machine to obtain a virtual verification machine; perform verification through the virtual verification machine in the isolation environment.

[0054] In addition, the logic instructions in the above-mentioned memory 330 can be implemented in the form of a software functional unit and can be stored in a computer-readable storage medium when it is sold or used as an independent product. Based on such an understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art or the part of the technical solution, can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk and other media that can store program codes.

[0055] In this embodiment, a computer-readable storage medium is provided, on which a computer program is stored. When the program is executed by a processor, the industry compliance verification method described in the above embodiment is implemented.

[0056] The computer storage medium of the embodiment of the present invention can adopt any combination of one or more computer-readable media. The computer-readable medium can be a computer-readable signal medium or a computer-readable storage medium. The computer-readable storage medium can be, for example, but not limited to, a system, device or device of electricity, magnetism, light, electromagnetic, infrared, or semiconductor, or any combination of the above. More specific examples (non-exhaustive list) of computer-readable storage media include: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In this document, a computer-readable storage medium can be any tangible medium containing or storing a program, which can be used by an instruction execution system, a device or a device or used in combination with it.

[0057] Computer-readable signal media may include data signals propagated in baseband or as part of a carrier wave, which carry computer-readable program code. Such propagated data signals may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. Computer-readable signal media may also be any computer-readable medium other than a computer-readable storage medium, which may send, propagate, or transmit a program for use by or in conjunction with an instruction execution system, apparatus, or device.

[0058] The program code embodied on the computer readable medium may be transmitted using any appropriate medium, including but not limited to wireless, wireline, optical fiber cable, RF, etc., or any suitable combination of the foregoing.

[0059] Computer program code for performing the operations of the present invention may be written in one or more programming languages ​​or a combination thereof, including object-oriented programming languages ​​such as Java, Smalltalk, C++, Ruby, Go, and conventional procedural programming languages ​​such as "C" or similar programming languages. The program code may be executed entirely on the user's computer, partially on the user's computer, as a separate software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In the case of a remote computer, the remote computer may be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., through the Internet using an Internet service provider).

[0060] The above-mentioned embodiments only express several implementation methods of the present invention, and the description thereof is relatively specific and detailed, but it cannot be understood as limiting the scope of the patent of the present invention. It should be pointed out that, for ordinary technicians in this field, several variations and improvements can be made without departing from the concept of the present invention, which all belong to the protection scope of the present invention. Therefore, the protection scope of the patent of the present invention shall be subject to the attached claims.

Claims

1. An industry compliance verification method, characterized in that: The method comprises the steps of: Create an embedded virtualization platform on the target backup server; At the time point of the verification task, the target recovery virtual machine is restored on the embedded virtualization platform; Dynamically generate multiple task isolation networks based on the IP addresses of the virtual machines in the verification task, and configure each target recovery virtual machine to communicate with its corresponding task isolation network; Create a virtual proxy gateway and a fixed intermediate isolation network. The virtual proxy gateway communicates with the intermediate isolation network and communicates with each task isolation network respectively. The communication between each task isolation network and the production network is controlled through the virtual proxy gateway. Setting up a target recovery virtual machine with all communication connections to fully simulate the operating environment and dynamic operations of the production machine to obtain a virtual verification machine; In an isolated environment, verification is performed by a virtual verification machine.

2. The industry compliance verification method according to claim 1, characterized in that: The step of dynamically generating multiple task isolation networks according to the IP addresses of the virtual machines in the verification tasks, and configuring each target recovery virtual machine to communicate with its corresponding task isolation network, further includes: When the data verification task contains IP addresses of virtual machines from different network segments, multiple task isolation networks are dynamically generated, and a unique network segment is set for each task isolation network; A first communication connection is configured for each target recovery virtual machine to connect to the corresponding task isolation network. The configuration of the first communication connection is to add a virtual network card to the recovery virtual machine.

3. The industry compliance verification method according to claim 1, characterized in that: The step of creating a virtual proxy gateway and a fixed intermediate isolation network, wherein the virtual proxy gateway communicates with the intermediate isolation network and communicates with each task isolation network respectively, and controlling the communication between each task isolation network and the production network through the virtual proxy gateway, further includes: Create a fixed intermediate isolation network and set a unique network segment for the intermediate isolation network; Create a virtual proxy gateway with layer 3 forwarding capabilities; configuring a second communication connection for the virtual proxy gateway to connect to the intermediate isolated network; configuring a third communication connection for the virtual proxy gateway to connect the respective task isolation networks; Modify the network information of the virtual proxy gateway through the floppy disk file; Among them, the second configuration communication connection and the third configuration communication connection are both to add a virtual network card and a unique IP address to the virtual proxy gateway.

4. The industry compliance verification method according to any one of claims 1 to 3, characterized in that: The step of performing the verification step by using a virtual verification machine in the isolated environment also includes: According to the user's instruction, a first screenshot of the verification target material on the production machine is collected, where the first screenshot is generated by a backup system client installed on the production machine; Collect a second screenshot of the verification target material on the virtual verification machine; Perform comparative analysis on the first screenshot and the second screenshot on the virtual verification machine to obtain screenshot comparison verification results.

5. The industry compliance verification method according to any one of claims 1 to 3, characterized in that: The step of performing the verification step by using a virtual verification machine in the isolated environment also includes: According to user instructions, obtain the specified original files / folders from the secure backup in the production environment; Calculate MD5 or hash values ​​for the original files / folders in the production environment and the files / folders restored in the isolation environment; Compare and analyze the calculated values ​​of the original files / folders in the production environment with the calculated values ​​of the files / folders restored in the isolation environment to obtain the file consistency verification result.

6. An industry compliance verification system, characterized in that: The system comprises: A virtualization platform setting module is used to create an embedded virtualization platform on the target backup server; A recovery module, used to restore the target recovery virtual machine on the embedded virtualization platform at the time point of the verification task; A task isolation network creation module is used to dynamically generate multiple task isolation networks according to the IP addresses of the virtual machines in the verification task, and configure each target recovery virtual machine to communicate with its corresponding task isolation network; An intermediate communication control setting module is used to create a virtual proxy gateway and a fixed intermediate isolation network. The virtual proxy gateway communicates with the intermediate isolation network and communicates with each task isolation network respectively. The communication between each task isolation network and the production network is controlled through the virtual proxy gateway. A synchronization setting module is used to set up a target recovery virtual machine that is fully equipped with communication connections to fully simulate the operating environment and dynamic operation of the production machine to obtain a virtual verification machine; The verification execution module is used to perform verification through a virtual verification machine in an isolated environment.

7. The industry compliance verification system according to claim 6, characterized in that: The task isolation network creation module further includes: A multi-task isolation network generation unit, used to dynamically generate multiple task isolation networks when the data verification task contains IP addresses of virtual machines from different network segments, and set a unique network segment for each task isolation network; The first communication configuration unit is used to configure a first communication connection for each target recovery virtual machine to connect to the corresponding task isolation network. Configuring the first communication connection is to add a virtual network to the recovery virtual machine.

8. The industry compliance verification system according to claim 6, characterized in that: The intermediate communication control setting module further includes: An intermediate isolation network creation unit, used to create a fixed intermediate isolation network and set a unique network segment for the intermediate isolation network; A virtual proxy gateway creation unit, used to create a virtual proxy gateway with a layer 3 forwarding function; A second communication configuration unit, configured to configure a second communication connection for the virtual proxy gateway to connect to the intermediate isolation network; A third communication configuration unit, configured to configure a third communication connection for the virtual proxy gateway to connect to each task isolation network; The proxy gateway network information modification unit is used to modify the network information of the virtual proxy gateway through the floppy disk file; Among them, the second configuration communication connection and the third configuration communication connection are both to add a virtual network card and a unique IP address to the virtual proxy gateway.

9. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the program, the steps of the industry compliance verification method according to any one of claims 1 to 3 are implemented.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, the industry compliance verification method as described in any one of claims 1 to 3 is implemented.

Images