Apparatus and method for two-way authentication