It's not easy. Ultimately, you're distributing the Silverlight application to users, and if those users want to examine its communications, they can do so.
If you do nothing to secure it, that's as simple as running a proxy such as Fiddler and just looking at what URLs it hits and what parameters it passes.
If you do take steps to secure it, bear in mind that since the users have the executable, they can reverse-engineer it. I've not disassembled a Silverlight app but I assume that like other .NET assemblies, it's not a particularly difficult process.
But if you want to put up a barrier to entry that will at least ensure that only people willing to make a genuine effort can reverse-engineer it, do something like this:
- Public/private key pair; public key is in the app, private key on your server
- All WCF calls include a parameter which is the other parameters concatenated and then encrypted with the public key
- Server verifies this parameter on all calls
If you want to take one more step to protect against replay attacks, add a timestamp parameter to all service calls. This timestamp (which is concatenated along with the other parameters before encrypting) is also checked; allow some leeway for clocks being out of sync, but if it's more than a few minutes different to the server clock, reject the call.
But before spending too much time doing all this, once again, don't expect it to be foolproof.