We have a web application which has a 3-tier architecture with the UI on a public server, the business logic methods exposed as web services on another server across the firewall, and a database on a third server.

Due to security reasons we are required to keep all business logic off of the public web server. We do this by using web services to connect to the middle tier.

How could we use StrataFrame to implement this architecture, with BO methods exposed as SOAP web methods to the UI layer?

Well, if you don't want any of your business processing done on the UI server, you could create your own intermediate BusinessLayer class (just inherit it from BusinessLayer and inherit all of your business objects from that instead of the SF BusinessLayer class).  In this class, you would want to override Save() so that when you call Save() on one of your business objects, it knows to serialize itself back to the application server to do the processing there.  Other than that, it would be easiest to create web service methods that return populated business objects (they're Serializable) and just call them from the UI.  So, the UI could get a populated BO, modify it, and then call Save(), which would serialize the BO back to the app server to do the actual saving.