Stop-and-Go-MIXes Providing Probabilistic Anonymity in an Open System