A method for proving time elapsed between successive events occurring in a node of an asynchronous network, said node comprising an embedded system partitioned into a trusted zone and an unsecured zone, the trusted zone comprising a secure execution environment or TEE wherein the integrity and confidentiality of the code and data are ensured, and a trusted hardware component or TPM including a first clock, called a control clock giving the time elapsed from its last initialisation and a monotonic counter indicating the number of initialisations of the control clock, the TEE environment having a second clock, called the system clock, and receiving on the one hand the TPM control clock and on the other hand a third clock, called the precision clock, from a peripheral external to the on-board system, the control clock having a greater degree of security than the system clock and the precision clock, the precision clock having greater precision and stability than the control clock and the system clock, the successive events including at least two events occurring successively in the node, called previous event and subsequent event, wherein: an application residing in the TEE environment measures the time at which the previous event occurs, the measurement being carried out using the first, the second and the third clocks, to provide a first, a second and a third time measurement relating to the previous event; said application measures the time at which the subsequent event occurs, the measurement being carried out using the first, second and third clocks, to provide first, second and third relative time measurements to the subsequent event; said application determines, from the measurements thus obtained respectively for the previous event and for the subsequent event, a first, a second and a third measurements of time elapsed between the previous event and the subsequent event; said application verifies the consistency of the first, second and third clocks by comparing the elapsed time measurements thus obtained and if they do not differ by more than a predetermined tolerance margin, forms a proof message of elapsed time between the previous event and the subsequent event, the elapsed time message comprising the value of the monotonic counter, the time measurements relating to the subsequent event and the drifts of the second (ε TEE) and third clock (ε GPS) relative to the first clock on the elapsed time interval; said application signs said message with a private key of the node before transmitting it over the asynchronous network. an application residing in the TEE environment measures the time at which the previous event occurs, the measurement being carried out using the first, the second and the third clocks, to provide a first, a second and a third time measurement relating to the previous event; said application measures the time at which the subsequent event occurs, the measurement being carried out using the first, second and third clocks, to provide first, second and third relative time measurements to the subsequent event; said application determines, from the measurements thus obtained respectively for the previous event and for the subsequent event, a first, a second and a third measurements of time elapsed between the previous event and the subsequent event; said application verifies the consistency of the first, second and third clocks by comparing the elapsed time measurements thus obtained and if they do not differ by more than a predetermined tolerance margin, forms a proof message of elapsed time between the previous event and the subsequent event, the elapsed time message comprising the value of the monotonic counter, the time measurements relating to the subsequent event and the drifts of the second (ε TEE) and third clock (ε GPS) relative to the first clock on the elapsed time interval; said application signs said message with a private key of the node before transmitting it over the asynchronous network.