Introduce Node Authentication Audit information for ATNA compliance

To reach ATNA compliance, we require a host of additional items to be truly compliant (listed below).
We could start light, and extend out - but having a holistic strategy here is critical for us to be compliant and should not hold up the Audit Trail work which is immensely valuable to existing customers.

ATNA Requirements

Secure Communication:
Nodes should communicate securely using authenticated and encrypted connections. This often involves the use of secure protocols such as TLS (Transport Layer Security) or its predecessor, SSL (Secure Sockets Layer).

Authentication Mechanisms:
Nodes must authenticate themselves before participating in communication. This involves verifying the identity of the node, ensuring that it is who it claims to be. Common authentication methods include username/password, digital certificates, or other strong authentication mechanisms.

Access Controls:
Access controls should be in place to ensure that only authorized nodes can access specific resources or perform certain actions. This helps prevent unauthorized access to sensitive healthcare information.
Certificate-based Authentication:

The use of X.509 certificates is often a key component of node authentication in healthcare systems. Each node typically has a unique digital certificate that is used for authentication during communication.

Certificate Revocation:
There should be mechanisms in place to handle certificate revocation. If a node's certificate is compromised or if the node is no longer trusted, the system should be able to revoke the certificate to prevent unauthorized access.

Time Synchronization:
Nodes should have synchronized clocks to ensure that timestamps in audit logs are accurate. This is crucial for tracking and correlating events accurately in the audit trail.

Audit Trail Generation:
Nodes are required to generate comprehensive audit logs. These logs should capture relevant events related to authentication, access, and other security-related activities. The audit trail should include information about the node, the action performed, and the timestamp.

Audit Trail Protection:
Audit logs should be protected against tampering. Measures such as digital signatures or other integrity checks can be employed to ensure that audit trail information remains reliable and unaltered.
Logging of Failed Authentication Attempts:

Unsuccessful attempts to authenticate should be logged, providing a record of potential security threats or unauthorized access attempts.

Policy Enforcement:
Policies should be in place and enforced to govern node authentication and access. This includes defining rules for which nodes can access specific resources and what actions they are allowed to perform.

The issue names no files, tests, or entry points. Start by reviewing the existing Audit Trail work and turning the listed ATNA requirements into an agreed scope; done requires a defined implementation strategy covering node authentication, certificate handling, access controls, time synchronization, and protected audit logging.