In an aspect of the invention, a network node configured to enable authentication of a user of a client device based on biometric data captured by the client device is provided, which network node receives a request to authenticate a user of a client device, the authentication request comprising a user identifier, fetch at least one set of enrolled transformed biometric data corresponding to the user identifier and a secret feature transform key with which the biometric data was transformed at enrolment of the transformed biometric data at the network node, and submit the transformed biometric data and the secret feature transform key over a secure communication channel to the client device.