A network node is configured to enable authentication of a user of a client device based on biometric data captured by the client device. The network node receives, from the client device, a request to authenticate a user that includes a first set of transformed biometric data transformed with a first secret feature transform key shared with the client device; fetches, from a secure end-user repository, a second set of enrolled transformed biometric data associated with the first set of transformed biometric data and a second secret feature transform key with which the second set of biometric data was transformed at enrolment of the transformed biometric data; and submits the second set of transformed biometric data and the second secret feature transform key over a secure communication channel to the client device.