A data protection method includes identifying data indicative of a software element parameter of a software element to be protected, which may be a hash of the software element image or carrier media image area. The method includes identifying data indicative of a medium parameter of a medium authorized to carry the software element, which may be a unique identifier embedded in a non-image area of the medium. A validation token is defined based on a predefined protocol and written to a non-image area of the medium, which token is a function of the software element parameter and medium parameter. A device for executing the software element uses the same predefined protocol to verify the token prior to allowing execution of the software element. If the software element is copied to another medium, the validation token is not verifiable for the copied software, thereby restricting execution of the copied software element.