A system and method for validating proof of transit of network traffic through network nodes (N), the node (N) comprising a set of input interfaces (20) receiving incoming packets, a first module (A) to identify a matching route within a routing table (23) and storing means (22) to provide next modules (B, C, D) with two private keys if the packet is matched and/or the packet metadata includes OPoT information. The second module (B) decrypts the OPoT metadata using the first private key associated to the link of the node from which the incoming packets are received. The node (N) has SSS metadata to be processed by a third module (C) for the correct generation of cumulative validation parameters. When the SSS process is finished by the third module (C), the fourth module (D) re-encrypts the OPoT metadata using the second private key before packet forwarding to the subsequent node in the path through output interfaces (21).