Maybe too high level of an overview, but here is how I've approached layering before, it is pretty much in line with your traditional N-tier architecture.
Web - interface between user's browser and your service layer, converts HTTP params into data your service layer would need.
--- Use Business Objects to communicate between these layers ---
Service - interface between your Web layer and your DAO layer, nothing specific to transmission protocols here, i.e. no HTTP requests/parameters, Business Objects in your case. All your business logic resides here. For example, if your web layer says "give permission 1 to user 1234", your service layer would convert permission one to READ and user 1234 to the UserEntity that backs it in the DB.
--- Use Entities to communicate between these layers ---
DAO - interface between your Service layer and the actual persistence mechanism, should be as dumb as possible, meaning if "purchase" object is expected to have a "user" object on it, the DAO should be given both, it should not have to deal with looking up the user for example.
Using this separation between layers makes it easy to unit test and maintain each layer independently of others. To elaborate on BO's, the biggest benefit of those if getting data from the front-end to the service layer encapsulated in a single object and it leaves looking up actual DB entries to the service layer. Hope it helps.