Secure provisioning methods and apparatus for mobile communication devices operating in wireless local area networks (WLANS)

A wireless local area network (WLAN) includes a plurality of wireless access points (APs) which provide communications for a plurality of mobile communication devices. One of the APs is designated as a provisioning AP and is set to have a substantially smaller RF coverage area than RF coverage areas of the other APs. A mobile device is positioned within the provisioning RF coverage region and associates with the provisioning AP with use of a provisioning service set identifier, for establishing layer-2 communications with the WLAN, and for accessing and operating in a provisioning virtual local area network (VLAN) of the WLAN. While the mobile device is associated with the provisioning AP and operating in the provisioning VLAN, the mobile device receives via the provisioning AP an IP address which is assigned to the mobile device, for establishing layer-3 communications with the WLAN. After the layer-3 communications are established, the mobile device participates in an authentication procedure via the provisioning AP with a provisioning server of the provisioning VLAN. After positive authentication of the mobile device using the authentication procedure, the mobile device participates in a provisioning procedure with the provisioning server via the provisioning AP, for receiving provisioning information from the WLAN for programming in the mobile device.