A method for authenticating a user for access to a service provider network: receiving, at a challenging process on a provider network node on a service provider premises from a customer network node on a customer premises different from the service provider premises, a Dynamic Host Configuration Protocol, DHCP, request for configuration data necessary to receive a unicast on an Internet Protocol, IP, network, wherein the DHCP request includes user identifier data that indicates a particular user identifier value; determining a current challenge value that can not be predicted by knowledge of any previous challenge value; sending to the customer network node a challenge message that includes the current challenge value; receiving from the customer network node a response message that includes a response value, wherein the response value is based on the current challenge value, the user identifier value and a particular password value; causing a verification value to be determined based on the particular password value, associated with the user identifier value in an Authentication, Authorization and Accounting server and the current challenge value using a secure process that renders impractical an attempt to derive the particular password value from the current challenge value and the verification value; determining whether the response value matches the verification value; and if it is determined that the response value does not match the verification value, then preventing a DHCP offer from being sent to the customer network node in response to the DHCP request, whereby unicast communication over the IP network by the customer network node is prevented; and wherein at least one of the challenge message and the response message is formatted according to a DHCP message format using a unique value for a DHCP message type option. receiving, at a challenging process on a provider network node on a service provider premises from a customer network node on a customer premises different from the service provider premises, a Dynamic Host Configuration Protocol, DHCP, request for configuration data necessary to receive a unicast on an Internet Protocol, IP, network, wherein the DHCP request includes user identifier data that indicates a particular user identifier value; determining a current challenge value that can not be predicted by knowledge of any previous challenge value; sending to the customer network node a challenge message that includes the current challenge value; receiving from the customer network node a response message that includes a response value, wherein the response value is based on the current challenge value, the user identifier value and a particular password value; causing a verification value to be determined based on the particular password value, associated with the user identifier value in an Authentication, Authorization and Accounting server and the current challenge value using a secure process that renders impractical an attempt to derive the particular password value from the current challenge value and the verification value; determining whether the response value matches the verification value; and if it is determined that the response value does not match the verification value, then preventing a DHCP offer from being sent to the customer network node in response to the DHCP request, whereby unicast communication over the IP network by the customer network node is prevented; and wherein at least one of the challenge message and the response message is formatted according to a DHCP message format using a unique value for a DHCP message type option.