A method of authenticating user access in a data packet network to a network resource, the data packet network having a plurality of public hotspot access points configured to communicate with a network core to provide access to authorised users of the data packet network , the method comprising: authenticating user access onto the data packet network via one of said plurality of public hotspot access points , based on a first set of authentication criteria; processing a request for the network resource from a network device associated with the authorised user; authenticating the authorised user and network device access to the network resource based on a second set of authentication criteria; and in response to a successful authentication, establishing a secure data tunnel connection to the network resource, characterised by : the network resource being a private network associated with the user and provided access to the Internet by a home access point ; and wherein the authentication based on the: first set of authentication criteria is performed at a user authenticator located in a core of the data packet network ; and second set of authentication criteria is performed at an authenticator located in the core of the data packet network and wherein the secure data tunnel is established between a VPN tunnel manager located in the core of the data packet network and the home access point associated with the user's private network . authenticating user access onto the data packet network via one of said plurality of public hotspot access points , based on a first set of authentication criteria; processing a request for the network resource from a network device associated with the authorised user; authenticating the authorised user and network device access to the network resource based on a second set of authentication criteria; and in response to a successful authentication, establishing a secure data tunnel connection to the network resource, characterised by : the network resource being a private network associated with the user and provided access to the Internet by a home access point ; and wherein the authentication based on the: first set of authentication criteria is performed at a user authenticator located in a core of the data packet network ; and second set of authentication criteria is performed at an authenticator located in the core of the data packet network and wherein the secure data tunnel is established between a VPN tunnel manager located in the core of the data packet network and the home access point associated with the user's private network . the network resource being a private network associated with the user and provided access to the Internet by a home access point ; and wherein the authentication based on the: first set of authentication criteria is performed at a user authenticator located in a core of the data packet network ; and second set of authentication criteria is performed at an authenticator located in the core of the data packet network and wherein the secure data tunnel is established between a VPN tunnel manager located in the core of the data packet network and the home access point associated with the user's private network . first set of authentication criteria is performed at a user authenticator located in a core of the data packet network ; and second set of authentication criteria is performed at an authenticator located in the core of the data packet network and wherein the secure data tunnel is established between a VPN tunnel manager located in the core of the data packet network and the home access point associated with the user's private network . <EOS>