Unfortunatly like a lot of things in video games it's a lot in-house r&d, public doc for those kind of problems is non existent.

The idea from my original post is that your gameserver should allow traffic only if the player is authenticated.