The protocol specification doesn't seem to address this.
- Transactions are first transmitted to all the nodes in the p2p network. At this point they are "unconfirmed".
- At some point a miner includes the transaction in a block. The transaction now has 1 confirmation.
- Miners continue to find blocks and the next block builds on the block that contains the transaction. The transaction now has 2 confirmations (the original block + 1 more after it in the block chain).
- Miners continue to find blocks, the next block that extends the chain makes the 3rd confirmation and the one after that makes the 4th, etc.
Clients determine the number of confirmations by counting the number of blocks in the block chain since the block that contains the transaction:
"Height of current longest chain" - "Height of chain for the block containing the transaction" + 1