A method of authenticating user access in a data packet network to a network resource, the data packet network having a plurality of public hotspot access points configured to communicate with a network core to provide access to authorised users of the data packet network, the method comprising: authenticating user access onto the data packet network via one of said plurality of public hotspot access points, based on a first set of authentication criteria; processing a request for the network resource from a network device associated with the authorised user; authenticating the authorised user and network device access to the network resource based on a second set of authentication criteria; and in response to a successful authentication, establishing a secure data tunnel connection to the network resource, characterised by: the network resource being a private network associated with the user and provided access to the Internet by a home access point; and wherein the authentication based on the: first set of authentication criteria is performed at a user authenticator located in a core of the data packet network; and second set of authentication criteria is performed at an authenticator located in the core of the data packet network and wherein the secure data tunnel is established between a VPN tunnel manager located in the core of the data packet network and the home access point associated with the user's private network. authenticating user access onto the data packet network via one of said plurality of public hotspot access points, based on a first set of authentication criteria; processing a request for the network resource from a network device associated with the authorised user; authenticating the authorised user and network device access to the network resource based on a second set of authentication criteria; and in response to a successful authentication, establishing a secure data tunnel connection to the network resource, characterised by: the network resource being a private network associated with the user and provided access to the Internet by a home access point; and wherein the authentication based on the: first set of authentication criteria is performed at a user authenticator located in a core of the data packet network; and second set of authentication criteria is performed at an authenticator located in the core of the data packet network and wherein the secure data tunnel is established between a VPN tunnel manager located in the core of the data packet network and the home access point associated with the user's private network. the network resource being a private network associated with the user and provided access to the Internet by a home access point; and wherein the authentication based on the: first set of authentication criteria is performed at a user authenticator located in a core of the data packet network; and second set of authentication criteria is performed at an authenticator located in the core of the data packet network and wherein the secure data tunnel is established between a VPN tunnel manager located in the core of the data packet network and the home access point associated with the user's private network. first set of authentication criteria is performed at a user authenticator located in a core of the data packet network; and second set of authentication criteria is performed at an authenticator located in the core of the data packet network and wherein the secure data tunnel is established between a VPN tunnel manager located in the core of the data packet network and the home access point associated with the user's private network.