Router/Switch authentication in the network

Hey everyone I'm interested in implementing an authentication scheme in my network for the network devices, other than using static MAC addresses which aren't thought of as particularly secure. The idea is something similar to Dot1X (certificates for example to authenticate an end device) but for routers and switches so that an attacker can't replace our router with his own since it would not be an authenticated device in the network. The solution needn't necessarily be based on something propriety to Cisco.

Thanks alot in advance,
Michael